<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Help users create complex passwords that are easy to remember ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-251221/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-19T03:05:13-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[Systemic Limitations]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2669297]]></link>
        <description><![CDATA[I *had* a set of rules that I had been using until I joined my most recent employer.  I can no longer use them.  They have extra stated requirements though most systems cannot enforce them...'the user must comply.'  Add to that we still have systems that will only accept 8 character passwords and they are *trying* elsewhere in the organization to implement SSO.  With the complex maze of systems that do not play well with each other as well as systems with different requirements and 90 day expirations for some systems and 30 day expirations for others - even personal password management is a nightmare.I know why our employees resist password security.We have had so much 'federated' management and growth, we have created a monster and no one really seems to give a d@mn.Can you tell I am frustrated?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2669297]]></guid>
        <dc:creator><![CDATA[DelphiniumEve]]></dc:creator>
        <pubDate>Tue, 30 Dec 2008 08:49:00 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[So you're saying that the built in delay...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2533870]]></link>
        <description><![CDATA[mechanism of Windows Policy doesn't work in this area? We've always set it up like that.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2533870]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Fri, 27 Jun 2008 08:54:38 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Passwords are not the problem]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2530726]]></link>
        <description><![CDATA[Instead of banging our heads against a wall trying to enforce elaborate passwords we should be telling software designers to fix the password entry routines. Everything I have written that requires a password only gives you three chances per 15 minutes. Get three wrong and the program will still accept typing passwords but just ignores them even if the right password is typed until the 15 minute timeout. I would guess this would slow down a brute force cracker to 1 or 2 years to crack an 8 character password.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2530726]]></guid>
        <dc:creator><![CDATA[Manitobamike]]></dc:creator>
        <pubDate>Tue, 24 Jun 2008 07:51:52 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[It depends on how you set it up...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2510344]]></link>
        <description><![CDATA[at least I remember several options when I was studying for my MCSE. Sorry I can't remember the details. Perhaps if you clicked the ask a question button on this discussion you would be better served by starting a new thread.This is an old thread; not to many people watching it anymore, I suspect.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2510344]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Thu, 29 May 2008 11:20:54 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Implemntation]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2507832]]></link>
        <description><![CDATA[Did any one ever respond about implementation of complex passwords.I currently run and AD domian just using simple passwords and want to change to complex however not sure what will happen if I change my group policy settings. Will it force everyone to change their passwords at next login or will it wait for the current password to expire before requesting change?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2507832]]></guid>
        <dc:creator><![CDATA[awilliams@...]]></dc:creator>
        <pubDate>Mon, 26 May 2008 21:02:36 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Complexity vs. writing.]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2422855]]></link>
        <description><![CDATA[I've seen users write down passwords that were six-letter common words or names.  There isn't as much correlation between complexity and writing as there is between writing and the number of other passwords the user has, or the user's comfort level with technology.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2422855]]></guid>
        <dc:creator><![CDATA[CharlieSpencer_Palmetto]]></dc:creator>
        <pubDate>Thu, 07 Feb 2008 08:41:26 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I always figured that was probably the case...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2421979]]></link>
        <description><![CDATA[it just adds a few more lines to their cracking dictionary.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2421979]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Wed, 06 Feb 2008 09:21:27 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[outdated trick]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2421219]]></link>
        <description><![CDATA[Those who create the brute force software know all your tricks and will include them for sure.5=S or a=@ or O=0, etc.The same story is with UPPER CASE/lower case. All these combinations are LAREADY inlcuded into the brute force software. It may be just will take several minutes longer than otherwise to break the password.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2421219]]></guid>
        <dc:creator><![CDATA[zbatia]]></dc:creator>
        <pubDate>Tue, 05 Feb 2008 13:56:59 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[DTS(Desktop Security)]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2416899]]></link>
        <description><![CDATA[Seems DTS has the function to solve Windows login. You can check.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2416899]]></guid>
        <dc:creator><![CDATA[Chinqin]]></dc:creator>
        <pubDate>Thu, 31 Jan 2008 02:38:28 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Good Choice but Need to Consider...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2416895]]></link>
        <description><![CDATA[Two-factor Authentication means (Personal Identification Number)PIN+USB TOKEN. OK..,the USB Token, hardware itself is  inexpensive, just several dollars or more based on the security level. However, we need to consider what security technology the token application based on. As I know, two-factor authentication is extended from PKI(Public Key Infrastructure) technology, which is to manage keys and certificates. So the user should pay for not only the token, but the certificates from (CA)Certificate Authority and the consultant charge about how to establish a system PKI based. That's quite a large amount. Generally, PKI is suitable for On-line Banking, Government, Public Utility, or enterprises gobally.And what solution is more effective and safe. I think OTP(one time password) is another choice. The users need only to set the server and them distribute the token. Of course, I also agree with Mike Mullins' opinion. This method is suitable for the web need lower security level protected. Thank you, Mike. You way actually can help me remeber the password for several month at least without the note. But Microsoft's ECE web asks me to change the password monthly and no letter and number repeated. Ahh...that's frequent for me. Maybe I need more training :o)]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2416895]]></guid>
        <dc:creator><![CDATA[Chinqin]]></dc:creator>
        <pubDate>Thu, 31 Jan 2008 02:29:42 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[TV's Mythbusters were using cheap technology...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2412966]]></link>
        <description><![CDATA[so I figure that is why they had success. It is good to know someone is building retina scanner that works well. I was always concerned that highresolution camera technology would be able to capture a person's retina image and make nefarious use of it. Your post indicates this isn't a worry; This was what I had confidence in - that todays technology was going to jell. I still don't like anyone having my finger print on file in any form. This and subcutaneous RFID tech are the only technologies I feel should be prevented as a civil rights/privacy issue.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2412966]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Sat, 26 Jan 2008 15:19:03 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[The only concern of biometrics is the civil rights one..]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2412687]]></link>
        <description><![CDATA[Having been into security (alarms, guards and guns one, not IT) business for ten years I happen to know a thing or two about biometrics. Both retinal scanners and fingerprint/handprint scanners in use for alarms and access control systems (not sure about Microsoft/Logitech OEM'd USB pieces you talk about though) expect your blood to flow, your heart to beat and your eyes to twitch in order to accept you. Chopped off finger or a rubber replica and a photo or a hologram-whatever of an eyeball just won't do. It takes a living human being and additional tests for the 'living' bit are made up every day. False positives are already reduced to zero in todays tech by using multiple algos for testing and multipass learning techniques. False negatives are not a big issue since two or three consecutive scans are much easier and MUCH less frustrating for the user than two or three complex passphrase retypes.Did you know that most alarm systems out there use only 4-8 digit numerical passwords, even for data connections? Tho, proprietary (in all senses, from electronics to data format) comm used for these systems, and limited time frame from first attempt to alarm going off if you're not authenticated render brute-force attacks useless. I've seen alarm systems fooled only in action/scifi flicks. In the real world, successful breaches require a gun pointed at the head of someone that can authorize.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2412687]]></guid>
        <dc:creator><![CDATA[bojan@...]]></dc:creator>
        <pubDate>Sat, 26 Jan 2008 00:42:03 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[RE: Help users create complex passwords that are easy to remember]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411758]]></link>
        <description><![CDATA[I like 2 small words of 4 to 6 characters each, something like &quot;Dogs and cats&quot;. Using the same method you use above it would become D0g5&amp;C@t$. Note that the &quot;S&quot; is converted to a 5 or a $. When the password expires chance the 5 to a 6 or some other character. Most people sound the password in their heads as they type. The trick is to say the character but type something else. After a while it becomes automatic and the fingers just do it for you.In my example there are 2 upper case, 2 lower case 2 numbers and 3 special characters. What's your password? Its simple dog and cats.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411758]]></guid>
        <dc:creator><![CDATA[Phil.J.Hayes@...]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 21:27:11 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[All I can find about the number of remembered passwords]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411372]]></link>
        <description><![CDATA[simply states something like: &quot;to avoid the vulnerabilities associated with password reuse&quot; but doesn't explain what these vulnerabilities are.That's little better than &quot;Because I said so, that's why!&quot;I'm going to start a new thread in the questions section. Maybe the possibility of getting thumbs will get me a real answer ]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411372]]></guid>
        <dc:creator><![CDATA[TonytheTiger]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 11:09:32 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[What about user IDs?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411015]]></link>
        <description><![CDATA[Passwords are only half of the equation.  Most companies use the user's name or a form if it for the user ID.  Example rfink, rfink01, etc.  EDS has the right idea, use randomly generated IDs.  When I worked for them my IDs ranged from j8s8oj to pzdf8v.  They have multiple systems for generating IDs.  After two days the average user will remember that.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411015]]></guid>
        <dc:creator><![CDATA[RFink]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 07:27:25 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Tip toe through the keyboard]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411011]]></link>
        <description><![CDATA[Personally I like passwords like:!z2x#c$vCreate a pattern on the keyboard, hit the shift key a few times, throw in a CTRL key and you're golden.EDITED -- Typo]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411011]]></guid>
        <dc:creator><![CDATA[RFink]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 07:23:20 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Your attitude is healthy and everyone should be suspicious..]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411008]]></link>
        <description><![CDATA[of government(or nosey corporations). But, I got to admit I don't worry about recognition tech like this because to me it is not too much different than living in a small town where no matter how much you might like to hide, everyone knows you and recognizes you  and probably knows more about your personal life than you care to share.It is more important to me that someone else doesn't pass as me.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2411008]]></guid>
        <dc:creator><![CDATA[JCitizen]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 07:20:13 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Your logic is wrong on several counts]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2410932]]></link>
        <description><![CDATA[First of all, your math is wrong. You are assuming that (a) there can only be one numeric digit and (b) it is always in the same location. Even if all the users simply append or prepend a single digit to a 7-letter password, but half the users put the digit in front and half put it behind, the total number of possibilities is double what you estimate. In reality, since there are 8 possible locations for the digit, the true number of passwords (assuming exactly one digit) is 26^7*10*8, which is about three times 26^8. If users are allowed two digits, the number of possibilities is 26^6*10^2*(8-choose-2). Second, dictionary attacks don't work by trying every possible combination. They work by assuming that some users will have weak passwords and trying a large number of common passwords to see whose account they can break. Forcing a user to include a digit somewhere prevents an attacker from simply trying common dictionary words or simple variations thereof (there are only something like 800,000 words in the English language, for example - several orders of magnitude lower than the 200 billion figure you came up with).Trying 200 billion combinations would take a loooong time without a dedicated supercomputer; you would need, on average, to try 100 billion of those combinations before getting lucky. There are approximately 33 million seconds in a year, which means 100 million every 3 years. 100 billion seconds would be 3000 years. So if you could try 10,000 combinations every second, you could crack a user's password, on average, every 4 months. It might be doable, but it's a lot of computing power to crack a single user account. And that, of course, is assuming exactly 8 lower-case alphabetic characters.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2410932]]></guid>
        <dc:creator><![CDATA[wlorimer@...]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 06:45:34 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[RE: Help users create complex passwords that are easy to remember]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2410911]]></link>
        <description><![CDATA[the password systems generally fail because it is attempting to have humans behave consistently - and we don't.  that being said, other methodologies should be improved - how something simpy stupid  like - have an automated string of characters float past on the login screen - then the user can only login after their trigger-character or phrase goes past.  the password can be as weak as you like, but if you key it in at the wrong time ,  no go.  You could have the screen flash colors or pictures just as easily.  AND - you can have a trigger picture/phrase that the user can login after for &quot;coerced logins&quot; - as a security feature.  I think the current strong passwords are more annoying than effective in a general population of users and a source of make-work for IT staff. and yeah - the 90-day rule for rolling passwords - stop that one now.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2410911]]></guid>
        <dc:creator><![CDATA[greg.hruby@...]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 06:34:03 -0800</pubDate>
    </item>
             

    <item>
        <title><![CDATA[minority report]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2410861]]></link>
        <description><![CDATA[Spiders. The stuff you see in sci-fi is usually already on the planning table, sometimes already deployed.I just don't want society to devolve into a perpetual identification of you and your whereabouts at every turn.Ever see &quot;Idiocracy?&quot; Notice the whole world is imbecilic and incompetent... BUT the automated total control scan grid still works, and the &quot;authorities&quot; mindlessly service it?Coming soon to a prison planet near you.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-251221-2410861]]></guid>
        <dc:creator><![CDATA[catseverywhere@...]]></dc:creator>
        <pubDate>Thu, 24 Jan 2008 05:48:57 -0800</pubDate>
    </item>
    </channel>
</rss>

