[IP] more on MS Security says to write down your passwords?!?!
Begin forwarded message:
From: Bob Hinden <bob.hinden@xxxxxxxxx>
Date: May 23, 2005 6:58:27 PM EDT
To: dave@xxxxxxxxxx
Cc: Bob Hinden <bob.hinden@xxxxxxxxx>
Subject: Re: [IP] MS Security says to write down your passwords?!?!
Dave,
Microsoft security guru: Jot down your passwords
There is a real problem here and he is probably correct. We are
instructed to use hard to forge passwords (i.e., not in the
dictionary, mixture of letters and number, etc.), we are not supposed
to write them down, we need to have passwords on many different
systems, and we are supposed to changed them periodically. Not
surprisingly, this just isn't possible.
I think it is better to write down passwords than to use passwords
that are easy to guess. The best method I have seen for this is to
have all the passwords start or end with the same character(s) and
not write down these character(s) in the list.
Personally I do a range of things to manage my passwords. I use high
quality password for accounts where my money is involved, medium
quality for sites that might retain my credit cards, and low quality
passwords for things where it doesn't matter too much (these are
usually duplicated), and I write down the passwords for accounts I
don't use too often and am likely to forget.
Where I work, they make me change my password much too often and
don't allow the reuse of the previous dozen passwords. I think this
actually reduces the security because it encourages people to write
down passwords and/or use trivial passwords. The scheme I came up
with was to have a constant set of numbers and letters and rotate the
letters through the numbers every time they make me change the
password. This makes it easier for me to remember it, but still
results in reasonable quality. BTW, once recently when I was going
through airport security, they made me show that my laptop was
working. This, of course, was the time that the disk encryption
software decided it was time for me to change my password. What fun....
Bob
-------------------------------------
You are subscribed as roessler@xxxxxxxxxxxxxxxxxx
To manage your subscription, go to
http://v2.listbox.com/member/?listname=ip
Archives at: http://www.interesting-people.org/archives/interesting-people/