Paasword or passphrase

[ITWombat]

What intstruction do you give your users about creating passwords. Do you require them to use a complex password or to string random words together to form a passphrase.

 

There's a gradual trend towards passphrases as they cover two security concerns, length and user friendlyness.Paassphrases will tend to be longer thus ensuring greater protection against automated attacks. The use of normal words would be easier to remember for non-geeks.

 

The one problem might be shoulder surfers for whom passphrases will be like plain text and take longer to type which is a bonus.

 

As for user friendlyness, I wonder how teachers will take to Diceware wordlists. You can imagine the scene in the staffroom. No it's not a Dungeon and Dragons revival it's just password renewal day.

[Geoff]

Well, personally, I think for within school there isn't really a need for it. However if your offering external services that pupils/teachers can access from home and your using some form of single sign on then I don't think you have a choice. If you have services exposed to the Internet you have to take password security seriously.

 

Under windows, there's several settings to enable/control complex passwords in Active Directory. Under Linux you can do this with the pam_cracklib.so module. I've no idea about Macs but I'd guess it'd be similar to the Linux situation.

[Grommit]

rightttt.. so we have to get the staff no longer user their kids/hamster/dog/cat/girlfriends name ?

 

Pandamonium would erupt :-)

[Andrew_C]

Well, personally, I think for within school there isn't really a need for it.

You are joking, aren't you? There is probably no one more likely, or better equiped to have a pop at your security than a bored, disgruntled teenager! We have suffed two serious attacks, both by (now ex)pupils. Our system now requires complex passwords. 3 out of the four UPPER, lower, number and punctuation; and a minimum length. Change every 40 days.

 

The significant problem is with keyboards that ma to US layout prior to log-on. This moves @ to " and visa-versa and causes no end of grief.

rightttt.. so we have to get the staff no longer user their kids/hamster/dog/cat/girlfriends name ?

What's wrong with "T1dd!es!"?

[eean]

Would recommending staff to use postcodes be a good idea? Perhaps not their own, but you'd have to be pretty determined to guess my nana's post code!

Also, how do phone numbers fair up to brute force attacks?

[SpuffMonkey]

you'd have to be pretty determined to guess my nana's post code!

 

That's one BIG banana! 8O

[eean]