Re: New Password rules at VRM610

Don't you think the password crackers have figure out the number for vowel trick and are using those variations in dictionary attacks? I don't think a password of f1shh3ad is any more secure anymore than fishhead. I like passphrases in mixed case for those accounts that need the highest security

-----Original Message-----
From: security400-bounces@xxxxxxxxxxxx [mailto:security400-bounces@xxxxxxxxxxxx] On Behalf Of Simon Coulter
Sent: Tuesday, April 22, 2008 5:50 PM
To: Security Administration on the AS400 / iSeries
Subject: Re: [Security400] New Password rules at VRM610


On 23/04/2008, at 4:14 AM, David Gibbs wrote:

Of course, one thing that all security administrators need to keep in
mind is the usability of the password restriction scheme that they
choose.

Overly complex password restrictions lead to forgotten passwords,
passwords on post-it notes, automatically stored passwords, etc.

The more complex security you put in place, the less security you
end up
having.

True, but you can teach users how to compensate and still satisfy
many requirements. For example, teach them to replace O by 0, I by 1,
E by 3, etc. Thus you can remove vowels (harder to guess passwords)
and require at least one digit (harder to guess passwords).


Regards,
Simon Coulter.
--------------------------------------------------------------------
FlyByNight Software OS/400, i5/OS Technical Specialists

http://www.flybynight.com.au/
Phone: +61 2 6657 8251 Mobile: +61 0411 091 400 /"\
Fax: +61 2 6657 8251 \ /
X
ASCII Ribbon campaign against HTML E-Mail / \
--------------------------------------------------------------------



_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.