Loading…
6
A red team guy at Def Con laughed at my 12 character password policy
He said length is the whole ballgame and my complex 12 char rule just made everyone write sticky notes, so we bumped the minimum to 20 and dropped the symbol weirdness. Anyone else find that longer and simpler beat shorter and uglier for actual users?
1 comments
Log in to join the discussion
Log In1 Comment
simon71719d ago
Taking the sticky note thing even further, the real problem isn't just that people write passwords down. It's WHERE they write them. I've seen monitor bezels, under keyboards, inside desk drawers, and my personal favorite, taped to the back of the laptop itself. A 20 character simple phrase like "coffee tractor window" is way easier to remember than "X7$mK!p2" and takes a million times longer to crack anyway. So you get the best of both worlds, people don't need the note, and even if they use one, the password is still a beast to break. The old rule was basically a master class in making everyone less safe while feeling smug about it.
3