Internetworkers: http://www.ibiblio.org/internetworkers/

[Scott <catfather AT donpoo.net>]

On Feb 17, 2005, at 4:53 PM, Evan Zimmerman wrote:

> I'd agree but I *do* like another idea (that's probably old as the
> hills) that came up recently. A researcher as MS has proposed that
> password schemes begin to require phrases instead of words for users.
>
> I'd imagine that the phrases would be both somewhat unique and easy to
> come up with and remember for most people, and the number of
> characters alone would dramatically increase the security compared to
> single dictionary words or the like that people use now. One downside
> of course would be a likely lack of numbers in the phrase but...

Common password used today: money
Common pass phrase used in the future: money money money money

Do you think one is really harder to crack than other? :)

On a similar note, the corporate password system requires changing 
passwords every 90 days and making sure the new password is distinct 
from the previous five passwords. Users have been using the automated 
recover password tool however to get around "the problem". As it goes, 
a user requests 5 password resets where on the 5th attempt they use the 
provided random password to set their new password back to the original 
password they've used in the past.

--
Scott