Software

Ask something
Discussion Locked

Interesting Password Policy - FUNNY!!!!!

0 helpful
7 replies

by dspeacock 3 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

CORPORATE DIRECTIVE NUMBER 88-570471

In order to increase the security of all company computing facilities, and to avoid the possibility of unauthorized use of these facilities, new rules are being put into effect concerning the selection of passwords. All users of computing facilities are instructed to change their passwords to conform to these rules immediately.

RULES FOR THE SELECTION OF PASSWORDS:

1. A password must be at least six characters long, and must not contain two occurrences of a character in a row, or a sequence of two or more characters from the alphabet in forward or reverse order. Example: HGQQXP is an invalid password. GFEDCB is an invalid password.

2. A password may not contain two or more letters in the same position as any previous password. Example: If a previous password was GKPWTZ, then NRPWHS would be invalid because PW occurs in the same position in both passwords.

3. A password may not contain the name of a month or an abbreviation for a month. Example: MARCHBC is an invalid password. VWMARBC is an invalid password.

4. A password may not contain the numeric representation of a month. Therefore, a password containing any number except zero is invalid. Example: WKBH3LG is invalid because it contains the numeric representation for the month of March.

5. A password may not contain any words from any language. Thus, a password may not contain the letters A, or I, or sequences such as AT, ME, or TO because these are all words.

6. A password may not contain sequences of two or more characters which are adjacent to each other on a keyboard in a horizontal, vertical, or diagonal direction. Example: QWERTY is an invalid password. GHNLWT is an invalid password because G and H are horizontally adjacent to each other. HUKWVM is an invalid password because H and U are diagonally adjacent to each other.

7. A password may not contain the name of a person, place, or thing. Example: JOHNBOY is an invalid password.

Because of the complexity of the password selection rules, there is actually only one password which passes all the tests. To make the selection of this password simpler for the user, it will be distributed to all supervisors. All users are instructed to obtain this password from his or her supervisor and begin using it immediately.

title edited

7 replies

by mjd420nova

They must have a whole squad of people just scanning passwords all day just to enforce this. I'd love to be on the programming team that has to write the formula for the program that would decide whether any passwords are in valid. Hackers would just walk away rather than try and figure that thing out.

by dspeacock

I'm in the middle of doing a SOX audit for a large company, looking at their third party interfaces and their controls. Some of these large companies have password policies that just make me cringe. A perfet example of this is NCTPTD (name changed to protect the dumb). Their requirement is 6 letters, no upper case/numbers/special characters needed, proper words allowed, no limit on repeating characters, 10 failed login attempts before a 5 minute lockout, and 120 day password life before change is required. And when they DO change passwords, they can reuse after 2 changes.

All I can say is that companies like that keep me busily employed.

(spelling fixed)

by nealecat

I remember a very similar posting on an internal Humor forum in IBM in the mid 80s, certainly with the exact punch line.

However about a year later an official password policy surfaced that was almost the same, just missing the punch line.

This discussion is closed to new replies.