Comments on: Forced password changes http://www.bytebot.net/blog/archives/2009/06/09/forced-password-changes A permanent record for what's interesting today - this is my live journal Wed, 10 Mar 2010 10:35:48 -0500 http://wordpress.org/?v=2.9.2 hourly 1 By: davidlian http://www.bytebot.net/blog/archives/2009/06/09/forced-password-changes/comment-page-1#comment-138639 davidlian Fri, 19 Jun 2009 01:59:26 +0000 http://www.bytebot.net/blog/?p=1546#comment-138639 Hey, that's what my employer does also... better security? Hey, that’s what my employer does also… better security?

]]> By: aubrey http://www.bytebot.net/blog/archives/2009/06/09/forced-password-changes/comment-page-1#comment-138603 aubrey Sun, 14 Jun 2009 04:22:32 +0000 http://www.bytebot.net/blog/?p=1546#comment-138603 shouldnt it be: my employer (link:www.oracle.com) ........ ??? shouldnt it be:
my employer (link:www.oracle.com) …….. ???

]]> By: Ruben http://www.bytebot.net/blog/archives/2009/06/09/forced-password-changes/comment-page-1#comment-138584 Ruben Wed, 10 Jun 2009 01:22:58 +0000 http://www.bytebot.net/blog/?p=1546#comment-138584 My employer makes me change my password every three months, and it can't be the last 5 passwords I've used, and it has to be extremely complex. Muchos Failure My employer makes me change my password every three months, and it can’t be the last 5 passwords I’ve used, and it has to be extremely complex.

Muchos Failure

]]> By: ShaolinTiger http://www.bytebot.net/blog/archives/2009/06/09/forced-password-changes/comment-page-1#comment-138580 ShaolinTiger Tue, 09 Jun 2009 08:46:28 +0000 http://www.bytebot.net/blog/?p=1546#comment-138580 Yah password policies are odd things, the more complex you make the requirements and the more often you require users to change their passwords the less secure it becomes. But then you're supposed to change passwords often enough that someone can't crack them. Then with computational power nowadays that's impractical too. That's why combining is the best option, at least 2 out of the 3 methods make things more secure (physical token, biometric, password). Yah password policies are odd things, the more complex you make the requirements and the more often you require users to change their passwords the less secure it becomes.

But then you’re supposed to change passwords often enough that someone can’t crack them. Then with computational power nowadays that’s impractical too.

That’s why combining is the best option, at least 2 out of the 3 methods make things more secure (physical token, biometric, password).

]]>