Re: Minimum password length

["Booth Martin" <Booth@xxxxxxxxxxxx>]

In a perfect World I would salute you Leif.  This is not a perfect World. 
There is a great deal of difference between perfect, effective, and reality.
 Nowhere in the original request from headquarters was there a request to
improve security.  The order was direct and to the point.  The order said
nothing at all about improving security.
 
The question asked was "will enforcing a minimum length of 8 be effective"? 

 
As to it being an ethical issue?  No way.  Wasting scarce company resources
to solve a problem that doesn't exist is what is unethical.  
 
Your particular interest is security, so to you every problem looks like a
security problem.  It reminds me of the cliche "I only have a hammer, so now
every problem looks like a nail."  
 
What little damage I have seen occur in the iSeries world has come from
people that already have the passwords, and are people with fairly high
security levels.  128 character passphrases would not have prevented one
single piece of damage I have ever seen.
 
 
 
 
---------------------------------------------------------
Booth Martin   http://www.MartinVT.com
Booth@MartinVT.com
---------------------------------------------------------
 
-------Original Message-------
 
From: Midrange Systems Technical Discussion
Date: Sunday, February 02, 2003 14:22:30
To: Midrange Systems Technical Discussion
Subject: Re: Minimum password length
 
From: Booth Martin <Booth@MartinVT.com>
 
The other possible meaning of "be effective" is "Will it get the home
office guy off the hook with his Auditor people who obviously don't know
squat about security?" I'd guess the answer to that is "yes" too.
 
---> and that is an unethical attitude. The objective is not
to keep some auditor off your back by sticking him with a lie,
but to actually improve security.