# Grr!! Do I REALLY need a case sensitive password 8 characters long?? **URL:** \ **Category:** The BBQ Pit\ **Created:** [September 10, 2006, 12:40pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151 "2006-09-10T12:40:12Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\ **Post date:** [September 11, 2006, 2:58pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/41 "2006-09-11T14:58:19Z")
[QUOTE=Dr. Drake] I don’t really understand the logic. Apparently, using “potato” or “Fluffums” as a password is equivalent to handing the terrorists keys and a map. [/QUOTE] In many cases, it is. See [dictionary attack](http://en.wikipedia.org/wiki/Dictionary_attack) for the details. If I can get a collection of password hashes, from the password file on your server or by sniffing your network. It is trivial to crack any passwords that are short, common names, common words, or are predictable in some other way. Numerous studies have shown that users are lousy at picking good passwords. Half of them would use “sex” if the system let them. ---
**Author:** ![Cubsfan](https://avatars.discourse-cdn.com/v4/letter/c/f4b2a3/32.png) [@Cubsfan](https://boards.straightdope.com/u/Cubsfan)\ **Post date:** [September 11, 2006, 3:33pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/42 "2006-09-11T15:33:16Z")
I’m in the military and my password must be FIFTEEN fucking characters long, have 1 uppercase and 1 lower case letter AND 1 special character, can’t have any words in it and it can’t “look like a word” like 100k or other leet gibberish. Oh, we have to change them every 90 days 2 and can’t reuse the same password within 20 changes. I forgot to add, if you think I work on some classified system you’re wrong. I’m in grad school at AFIT and these computers are stictly on the .edu domain. Fucking retarded. ---
**Author:** ![Gala\_Matrix\_Fire](https://avatars.discourse-cdn.com/v4/letter/g/4da419/32.png) [@Gala\_Matrix\_Fire](https://boards.straightdope.com/u/Gala_Matrix_Fire)\ **Post date:** [September 11, 2006, 3:34pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/43 "2006-09-11T15:34:41Z")
[QUOTE=Stinkpalm] I’m in the military and my password must be FIFTEEN fucking characters long, have 1 uppercase and 1 lower case letter AND 1 special character, can’t have any words in it and it can’t “look like a word” like 100k or other leet gibberish. Oh, we have to change them every 90 days 2 and can’t reuse the same password within 20 changes. I forgot to add, if you think I work on some classified system you’re wrong. I’m in grad school at AFIT and these computers are stictly on the .edu domain. Fucking retarded. [/QUOTE] What, you have just one password and you’re complaining? ---
**Author:** ![Sailboat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sailboat/32/461_2.png) [@Sailboat](https://boards.straightdope.com/u/Sailboat)\ **Post date:** [September 11, 2006, 3:42pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/44 "2006-09-11T15:42:15Z")
[QUOTE=Absolute] I’m too lazy to check, but **SHAKES** , I assume that you will not be one of the people piling on the next company that leaks a few million credit card numbers because of lax security? > [@](#): > > Also, did we really have a problem before with security breaches?? > > I think not!! That’s the same logic that doomed the Space Shuttle Columbia. All it proves is that you’ve been lucky in the past. [/QUOTE] Not quite. NASA was aware of the recurring problems with foam fragments and aware of concurrent problems with tile damage. They knew they had problems. The failure was in how those problems were prioritized and addressed, especially higher up the chain of command. Not the same thing as denying a problem. Sailboat ---
**Author:** ![Gadarene](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@Gadarene](https://boards.straightdope.com/u/Gadarene)\ **Post date:** [September 11, 2006, 3:42pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/45 "2006-09-11T15:42:23Z")
> [@](#): > > In many cases, it is. In many cases, it is “equivalent to handing the terrorists keys and a map”? I don’t see how that follows. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [September 11, 2006, 3:53pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/46 "2006-09-11T15:53:03Z")
[QUOTE=Jackmannii] This is a hopelessly low-tech concept, but I believe that an essential component of a password is that you should be able to remember it. [/QUOTE] If IT departments would come up with some **useful** password training (such as how to construct a strong password from an easily memorized phrase using some simple rule – e.g. take the first letter of each word followed by the number of letters in the word, and so on for each word in the phrase) instead of the silly hectoring they actually do, the problem might actually get solved. ---
**Author:** ![Sailboat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sailboat/32/461_2.png) [@Sailboat](https://boards.straightdope.com/u/Sailboat)\ **Post date:** [September 11, 2006, 4:55pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/47 "2006-09-11T16:55:30Z")
[QUOTE=jjimm] Gingham buttfuck. [/QUOTE] Let me refer you to [calico sex](http://boards.straightdope.com/sdmb/showthread.php?t=387694). 🙂 Sailboat ---
**Author:** ![Dead\_Badger](https://avatars.discourse-cdn.com/v4/letter/d/848f3c/32.png) [@Dead\_Badger](https://boards.straightdope.com/u/Dead_Badger)\ **Post date:** [September 11, 2006, 5:48pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/48 "2006-09-11T17:48:56Z")
[QUOTE=Gadarene] In many cases, it is “equivalent to handing the terrorists keys and a map”? I don’t see how that follows. [/QUOTE] I think **mks57** was treating **Dr. Drake** ’s phrase as the gentle hyperbole it was. And yes, a real-word codebook is many orders of magnitude smaller than one containing arbitrary alphanumeric strings. This could very easily be the difference between a system being cracked or not; particularly since the cost of a dictionary attack is directly proportional to the number of possible passwords. There are about 1,000,000 English words, depending on whose estimate you believe. The number of possible 8-character case-sensitive passwords with numbers allowed is (26\*2 + 10)^8 = 2.2 \* 10^14. So that’s about 8 orders of magnitude difference; a huge margin when you’re trying a brute-force attack on a system. As noted, these are pretty rare (and can be protected against in a number of ways), but still. By voluntarily restricting yourself to barely 1 billionth of the possible passwords available to you, you are most certainly handing a huge advantage to anyone intending to find out your password by brute force. Obviously, setting unreasonable password requirements that cause even well-meaning users to resort to writing down their passwords is just as stupid, but setting real-word passwords (even if you’re allowed to) is still pretty silly. ---
**Author:** ![Lemur866](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lemur866/32/434_2.png) [@Lemur866](https://boards.straightdope.com/u/Lemur866)\ **Post date:** [September 11, 2006, 6:01pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/49 "2006-09-11T18:01:31Z")
This is the dumbest thing. Yeah, passwords need to be secure. But if a user can’t remember their password, they’re going to write it down. It is GUARANTEED that they will write it down. And if you make it a firing offense to write down a password, they’ll just write it down but not stick it too their monitor. And if you require a dozen passwords, all system generated, all changing every 30 days, there’s absolutely no way for a normal human being to memorize them. It can’t be done. One user-generated strong password that changes every 90 days is within human limits. A dozen system generated strong passwords are not. And then you’ve got a situation comparable to buying the strongest vault on the market, with totally unbreakable locks, and then having the employees leave the bank vault open all the time because it’s too much trouble to have to open and close it all the time. If people can’t do their jobs because “security” is too stringent, they’ll figure out ways to bypass the security so they can actually get work done. The more you “tighten” security, the more security holes the users will create. The only secure system would be one with no users. ---
**Author:** ![MEBuckner](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mebuckner/32/2896_2.png) [@MEBuckner](https://boards.straightdope.com/u/MEBuckner)\ **Post date:** [September 11, 2006, 6:10pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/50 "2006-09-11T18:10:40Z")
The logic of saying you “can’t use a word”–even some really random word, like “zoetrope”–is that it would be vulnerable to a “brute force dictionary attack”. But with any password system worth jack shit, wouldn’t that go something like “aardvark…aardwolf…Aaronic…aasvogel…abacus…You’re account has been locked for repeated password violations. Please contact the system administrator to have your password reset”? ---
**Author:** ![Dead\_Badger](https://avatars.discourse-cdn.com/v4/letter/d/848f3c/32.png) [@Dead\_Badger](https://boards.straightdope.com/u/Dead_Badger)\ **Post date:** [September 11, 2006, 6:52pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/51 "2006-09-11T18:52:39Z")
Yep; that and limiting the rate at which login attempts can be made. However attacks of this nature need not only be made by simply inputting the password; should the attacker be able to get hold of the encrypted version of the password (which is transmitted by many network authentication schemes), he can then use that to try and work out the original password. Having a reduced dictionary of candidate passwords greatly simplifies this sort of attack too. Plus, having your accounts automatically lock out after three failures becomes a fairly attractive way of attacking your system itself; if a hacker only wants to cause mischief, locking everyone out of their computers simultaneously sounds like a great wheeze. ---
**Author:** ![Dead\_Badger](https://avatars.discourse-cdn.com/v4/letter/d/848f3c/32.png) [@Dead\_Badger](https://boards.straightdope.com/u/Dead_Badger)\ **Post date:** [September 11, 2006, 6:54pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/52 "2006-09-11T18:54:35Z")
Accursed new page. My reply, of course, is to **MEBuckner**. ---
**Author:** ![AHunter3](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ahunter3/32/368_2.png) [@AHunter3](https://boards.straightdope.com/u/AHunter3)\ **Post date:** [September 11, 2006, 7:29pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/53 "2006-09-11T19:29:06Z")
Incidentally, and totally off the subject, but every time I see this thread title, I read it as “ **Grrl!** Do I REALLY need a case sensitive password 8 characters long?” ---
**Author:** ![Elendil\_s\_Heir](https://avatars.discourse-cdn.com/v4/letter/e/7cd45c/32.png) [@Elendil\_s\_Heir](https://boards.straightdope.com/u/Elendil_s_Heir)\ **Post date:** [September 13, 2006, 8:38pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/54 "2006-09-13T20:38:31Z")
I’m sure you’ve heard of the kid who created the password “SupermanSpidermanBatmanGreenLanternWonderWoman.” Because he was told it had to be at least five characters long. Anyhoo… my department just adopted a new password policy. All passwords must henceforth be at least EIGHT characters long, have at least one uppercase and at least one lowercase character, at least three numbers, and have no more than three sequential numbers or letters in a row (no “1234” or “abcd,” etc.). Oh, and the passwords must be changed every 90 days. Fucking pain in the ass. ---
**Author:** ![carnivorousplant](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/carnivorousplant/32/3563_2.png) [@carnivorousplant](https://boards.straightdope.com/u/carnivorousplant)\ **Post date:** [September 14, 2006, 12:08am UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/55 "2006-09-14T00:08:00Z")
[QUOTE=Elendil’s Heir] Oh, and the passwords must be changed every 90 days. [/QUOTE] 1A2b3C4d and change to A2b3C4d1 then 2b3C4d1A etc. 🙂 ---
**Author:** ![begbert2](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/begbert2/32/3357_2.png) [@begbert2](https://boards.straightdope.com/u/begbert2)\ **Post date:** [September 14, 2006, 12:11am UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/56 "2006-09-14T00:11:33Z")
[QUOTE=Elendil’s Heir] Anyhoo… my department just adopted a new password policy. All passwords must henceforth be at least EIGHT characters long, have at least one uppercase and at least one lowercase character, at least three numbers, and have no more than three sequential numbers or letters in a row (no “1234” or “abcd,” etc.). Oh, and the passwords must be changed every 90 days. [/QUOTE] StandardPassword001, StandardPassword002, StandardPassword003… You’ll hit a problem at 12, 123, 234, etc, but you can just skip those. 🙂 ---
**Author:** ![TheLoadedDog](https://avatars.discourse-cdn.com/v4/letter/t/35a633/32.png) [@TheLoadedDog](https://boards.straightdope.com/u/TheLoadedDog)\ **Post date:** [September 14, 2006, 1:26am UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/57 "2006-09-14T01:26:35Z")
I think in this day and age, passwords shouldn’t have those strict requirements. Say make them six or more character long, but beyond that, do what you like. When I log in to the payroll system at work, it must be a password of exactly six characters, and no numbers or special characters. Other systems say you MUST have numbers in them. It’s a pain in the arse. Anyway, I have to change my password every six weeks, so I just reverse it, then put it the right way around six weeks later. ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [August 2, 2010, 2:54pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/58 "2010-08-02T14:54:28Z")
> [@aerodave](#): > > My work passwords have to be at least 8 characters, and include at least one of each of the following: > > 1. lower case letters > 2. upper case letters > 3. numbers > 4. special characters (!@#$, etc) > > Not only that, but the servers use a word checker to make sure that you’re not making a password out of a real word. If three or more consecutive letters form a word in the dictionary, the password is unacceptable. And that’s hard, because a lot of three-letter combinations are words. > > And, of course, we have to change our passwords every 90 days. > > So far..I win! Ouch! Except for the “no 3 characters may form a word” I was thinking that I’d win: ours have to be 14 characters and all the other stuff applies as well. Interestingly, when they first changed it from 8 (or whatever) to 14, the instructions still said 8… so we were extra-special-frustrated with that first password change when the damn system wouldn’t TAKE the new passwords. So I have the following when I log in to work every day: hard drive PGP Windows email intranet client network (Citrix) Client task-tracking tool Client Unix box Database account Several different user accounts on each of several different databases (as in, up to 4 users on one, up to 4 on the next, etc.) Timesheet tool Then there are all the assorted _personal_ logins. I _may_ win for sheer number of passwords I might have to enter in any given day (this is ignoring the personal ones). ---
**Author:** ![Mama\_Zappa](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@Mama\_Zappa](https://boards.straightdope.com/u/Mama_Zappa)\ **Post date:** [August 2, 2010, 2:56pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/59 "2010-08-02T14:56:07Z")
> [@TheLoadedDog](#): > > I think in this day and age, passwords shouldn’t have those strict requirements. Say make them six or more character long, but beyond that, do what you like. When I log in to the payroll system at work, it must be a password of exactly six characters, and no numbers or special characters. Other systems say you MUST have numbers in them. It’s a pain in the arse. > > Anyway, I have to change my password every six weeks, so I just reverse it, then put it the right way around six weeks later. Only works if your system doesn’t prevent re-use (all of mine now do this). The “standard001, standard002” format sometimes fails too - some systems look for even partial matches on reuse. ---
**Author:** ![Chimera](https://avatars.discourse-cdn.com/v4/letter/c/8e8cbc/32.png) [@Chimera](https://boards.straightdope.com/u/Chimera)\ **Post date:** [August 2, 2010, 3:02pm UTC](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151/60 "2010-08-02T15:02:55Z")
Very easy. “June2010” “July2010” “Augu2010” etcetera One capital letter, four numbers, changed every month, easily remembered. [Previous page](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151.md?page=2) [Next page](https://boards.straightdope.com/t/grr-do-i-really-need-a-case-sensitive-password-8-characters-long/372151.md?page=4)