User IDs
I was always under the impression that if potential hackers didn't even know the format that user IDs took then that was yet another good barrier, before they even got to thinking about trying to hack the passwords. That is why all of the workstations on my little school network have the "Do not display last user name" policy enabled and I entreat staff not to logon in front of the students (shouldersurfing - I like that term ). Certainly increasing the complexity of the user ID seems a better way to go for increasing security rather than expecting Joe Public to make a more complex password. At least unti bio-scanning takes over everywhere.
