Re: New Password rules at VRM610

Don't you think the password crackers have figure out the number for vowel trick and are using those variations in dictionary attacks?  I don't think a password of f1shh3ad is any more secure anymore than fishhead. I like passphrases in mixed case for those accounts that need the highest security

-----Original Message-----
From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected] [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of Simon Coulter
Sent: Tuesday, April 22, 2008 5:50 PM
To: Security Administration on the AS400 / iSeries
Subject: Re: [Security400] New Password rules at VRM610


On 23/04/2008, at 4:14 AM, David Gibbs wrote:
> Of course, one thing that all security administrators need to keep in
> mind is the usability of the password restriction scheme that they
> choose.
>
> Overly complex password restrictions lead to forgotten passwords,
> passwords on post-it notes, automatically stored passwords, etc.
>
> The more complex security you put in place, the less security you
> end up
> having.

True, but you can teach users how to compensate and still satisfy
many requirements. For example, teach them to replace O by 0, I by 1,
E by 3, etc. Thus you can remove vowels (harder to guess passwords)
and require at least one digit (harder to guess passwords).


Regards,
Simon Coulter.
--------------------------------------------------------------------
    FlyByNight Software         OS/400, i5/OS Technical Specialists

    http://www.flybynight.com.au/
    Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
    Fax:   +61 2 6657 8251                                   \ /
                                                              X
                  ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.