Passwords - 64 Characters, Changed Daily?

isepic writes "It seems over the past few years that the password requirements have changed - each time making it even more difficult to crack. My company just changed its password requirements from 180 days down to 90 for most servers and from a minimum of six characters up to eight. So, as parallel processing computer clusters gain in power according to Moore's law, how are we expected to change them in the next 2-10 years --- and how often?"

"Hopefully by then, there will be a better way, but I really don't want to have to change my password every 8 hours, and not be able to use the last 5 I've used, AND have them each be some awfully long and complex string of hard-to-remember ASCII codes just because a computer can crack a 32 char password in 10 seconds.

What are your thoughts? Do you think one day we'll be SOL, or do you think something 'better' may come (e.g. biometric scanners on every keyboard and or mouse and or monitor - etc.)"

Comments

Just do what I do

[thammoud]

password1 password2 password3 password4 based on the month that you are in.

Re:Just do what I do

[Anonymous Coward]

just checked, you don't do that.

Re:Just do what I do

[kv9]

in soviet russia passwords change *you*.

Re:Just do what I do

[geekoid]

IN comedy, it is well know that something can become funny again.

BTW, not everyone shares YOUR sense of humor.

In Soviet Russia, nostalgia jokes you.

Re:Just do what I do

[gotacap]

You know, I had a strong password generator on my website for a while, but then I realized that most people paranoid enough to use a generator would be paranoid that I would be logging all strong password requests and then trying the results to get into the machines I found in my server logs... It's still there, I use it myself, but I don't tell my users where it is anymore.

Re:Just do what I do

[Anonymous Coward]

ObSpaceballs:

Dark Helmet: "1 - 2 - 3 - 4 - 5? That's the kind of combination an idiot would have on his luggage!"

President Scroob: "1 - 2 - 3 - 4 - 5? That's the same combination I have on my luggage!"

Re:Just do what I do

[Drachemorder]

"On one occasion I chose 123456"

That's amazing! I have the same combination on my luggage!

Re:Just do what I do

[nanojath]

Even worse, it encourages people to write their passwords down and store them in what is probably a very insecure location!

Hold on, are you saying that the post-it note labled "network password" on my cubicle wall is insecure?

Re:Just do what I do

[OptimizedPrime]

If you want to use a sticky note, contaminate it with lsd and put the password behind it, covered by the note. Net admins can be told to wear gloves...

Good news for hacker

[usefool]

Wasn't there a joke that if users are required to change password every second, hackers just need to keep on trying the same password until users themselves changed to match the hacker's password?

Re:Good news for hacker

[Anonymous Coward]

I think you got it wrong. Doesn't this joke involve monkeys and Shakespear...

Re:Good news for hacker

[ryanvm]

Wasn't there a joke that if users are required to change password every second, hackers just need to keep on trying the same password until users themselves changed to match the hacker's password?

I doubt it - jokes are supposed to be funny.

Length & Considerations

[Oculus Habent]

I could see a password of substantial length made of a phrase. Say, 64+ characters, changed every two weeks might be fine. Especially if you have a well-read workforce, which might enjoy making note of significant passages.

You might want to [optionally] be able to use the first letter of each word as a "shorthand" password for re-verification moments, because typing in a 64+ character phrase everytime you lock your station could become tedious if you are away from your desk often.

Alternately, if you have a number of services at work that should have different password, some sort of secure password comparison tool could be employed to at least ensure that employees aren't using the same password for everything. Not sure about an architecture for that, though.

Re:Biometrics

[wkitchen]

Oh, that'll be just great. Chopping off fingers and plucking out eyeballs will be the new definition of "social engineering".

The problem is the input device, not pass length

[GuyFawkes]

typing
kGNisksUI725K-{P#~iuiILl896&Tui@'p;p'HHP O~9yu* *(

is going to be a pain in the ass for anyone if the input method is always going to be a qwerty keyboard...

on the other hand a 20 dollar mongrel dog that I feed every day will never mistake me for anyone else...

_electronic_ based biometrics however will completely suck

Perhaps make it more user friendly..

[t_allardyce]

Windows XPs new password policy manager: "Im sorry, that password has already been taken by user john, please choose another"

I don't see the problem at all!

[termos]

Luckily I have Gator for remembering all my passwords!

Re:Biometrics

[Roofus]

Chopping off fingers and plucking out eyeballs will be the new definition of "social engineering".

Holy great hell, I'd love to see the social engineer that can convince somebody to chop off a finger voluntarily. They would put Mitnick to shame!

Here goes my Karma....

[lewko]

Note to mods...these 'In Soviet Russia' remarks are never, ever funny. Even if you remember a time

In Soviet Russia, time remembers you!