Reply to: Stupid windows password screen!

[BigRed]

Bit different at work where you can simply keep a password-protected spreadsheet and just need to remember the one password if SSO is not implemented.

I think it's improved now, but there were macros available which would crack excel passwords in a couple of minutes. I used to use one to crack all those quizzes with protected sheets/cells

[unixman]

Lol.

At BT on NHS Spine once, Windows team got it in the neck for weak passwords, so they issued us with 24 character ones, no dictionary words, upper/lowercase, numbers and punctuation.

Was no problem though since we all had them on post-it's under our keyboards. So much for security........

[LondonManc]

Is that actually too insecure though? If someone has to physically steal it from your desk... and only people who work there know that's what you do?

Asked the retired cleaner from Talktalk

[d000hg]

Is that actually too insecure though? If someone has to physically steal it from your desk... and only people who work there know that's what you do?

[stek]

At BT on NHS Spine once, Windows team got it in the neck for weak passwords, so they issued us with 24 character ones, no dictionary words, upper/lowercase, numbers and punctuation.

Was no problem though since we all had them on post-it's under our keyboards. So much for security........

[unixman]

I use keepass, it can generate passwords for you if you want.

Whs. Or keypassx as it is known on the Unix side of the fence.

[LondonManc]

Write them down at home and keep them somewhere away from your PC. Burglars will be after your kit, not your IPR (my NAS with copies of important docs is in a separate room to the PC).

Bit different at work where you can simply keep a password-protected spreadsheet and just need to remember the one password if SSO is not implemented.

[unixman]

Won't let me set a password because it doesn't meet the requirements (length, complexity, etc) but won't tell me what the requirements are.

Ugh. This is one of those paper cuts that makes you think "why... how could this happen... how could such a crass bug make it through to release...".

XKCD passwords are the best (https://xkcd.com/936/). I use 'em for all me Internet things. Maybe.

[woohoo]

I use keepass, it can generate passwords for you if you want.

[Sysman]

The other thing I don't get is people who update one work password, but not all the others, so they end up with a piece of paper containing their 10 different work passwords.

One reason is where different applications or internal web sites have different password requirements. At one place the mainframe timesheet web interface only accepted an 8 digit number.

[Sysman]

The default is 8 symbols length with complexity (3 out of 4 upper case, lower case, number, symbol). Password1 fulfils the default requirements if the default length is changed to the more popular 12 - Password12345 is your friend

My favourite is P@ssw0rd.

That's a complexity score of 4 out of 4. Just keep going with abcd or 1234 for the required length.

[_V_]

Chane your password every morning to the current date, put it through a hash.

So today's password is 62d815fd6cf414e69c2c612849265610

[DaveB]

I think its set at a corporate policy level by domain controller. The most painful is when they expire after 8 weeks and you choose a new one and it cannot be one used previously and cannot follow patterns like 1234 etc etc. I have had to write down passwords FFS !

There is an argument that says that writing down passwords is actually ok, provided you protect the password itself. It actually means people are more willing to use strong / complex passwords as they don't have to worry about remembering them.

This is why password vault apps for phones etc are so popular.

[Bluespider]

All i hear is challenging, not impossible.

Segregation of environments aside, there are ways to put SSO in front of even the trickiest applications/legacy systems.

[WTFH]

SSO anyone?

10 passwords for one place? whats the clientco? I could sort that out for a price!

SSO would work, and does for many of the applications, but this place has 3 different reporting tools and an ERP system that aren't set up for SSO, and then there's the two pricing tools, the 3rd party systems that are interfaced. If you are allowed access to the test and live systems, you have different passwords for each...


...It goes on.