& make sure you don't write that password down

[j666]

@adhemar

I have a govenment password that must be 14 characters, must have at least one capital letter, one special character and one numeral, no repeat letters and no known words, also no previously used them.

Why don’t they use biometric? It has to be cheaper than maintaining staffing levels necessary to reset all the forgotten passwords.

[Leaper]

@adhemar

I have a govenment password that must be 14 characters, must have at least one capital letter, one special character and one numeral, no repeat letters and no known words, also no previously used password. I have to use a password generator and it still rejects those. also the password is only good for 60 days.

… And writing it down is punishable by up to a week in a federal jail for endangering the integrity of a government system.

[gotpasswords]

[QUOTE=Nava]
Oh and the ones who require “special characters” but of course it’s a limited list thereof. Your webpage shouldn’t go into spasms if someone types a diacritic into a password field.
[/QUOTE]

Don’t blame your bank or whatever is being fussy. Blame legacy operating systems and applications.

It’s not the website (e.g.: Weblogic or Apache) that can’t handle funny characters. It’s the back-end database that will be knocked sideways into next Thursday. As one example, Oracle will interpret the backslash as an escape to change characters in the string, unless the user knows to enclose the password with double quotes. Likewise, Oracle wants to use $ and % as environment variables, so passwords that start with those may cause problems. SQL and DB2 also have their own quirks. Watch out for little Bobby Tables.

As a side note, crackers can use these requirements to “footprint” the system and identify the operating system, webserver middleware and backend database, so some sites don’t describe the requirements, thinking it’s safer that way. In reality, it just irritates the valid users.

[Deeg]

@Blaster_Master

And for some of the schemes mentioned here, you’re making a critical mistake. You cannot use a scheme such that if someone knows one password of yours, they can guess another. Consider for a moment that if I use, say, that element password scheme everywhere, then is someone gets happens to get my password from an insecure site, say a random poorly secured website on the internet, it wouldn’t take much to guess what my password might be on a critical site, like my bank or email. I think the sports one I saw works pretty well because the association between the password and the memorization clues isn’t obvious.

While you are technically correct it’s really not a big deal for a vast majority of people. Hackers are trying to crack things roboticly; they aren’t going to waste time trying to figure out if someone is using a system unless it’s worth their while. Bill Gates probably shouldn’t use a system; most Dopers can get away with it.

[Little_Nemo]

The next dog I have, I’m going to name him Password just to mess with sysadmins.

[GrumpyBunny]

@Chimera

But as far as many users are concerned, we may have filed it at the bottom of a locked filing cabinet in a disused lavatory. It’s not like they read the emails they get, never mind actually looking for useful information. If it doesn’t fall like manna from the sky, they wouldn’t know about it.

I hear your annoyance, but I’ll point out that some users are freakin’ drowning in email. (I would get literally 8,000 a day at my old job, most totally pointless “This file loaded” crap, but even with rules and auto-delete, it’s a PITA to keep up.)

[AtomicDog]

@Spiderman

It might be a legacy system, but *Non-alphanumeric character check have at least 1 of the following non-alphanumeric characters: _, _ * is a new requirement.

I had a system, but it was based on 8 chara, not 7.

I heard of setting up your account with your mother’s maiden name as either “I can’t tell you that” or “Fuck you”, which would make for interesting account validation conversation when you call your credit card for any reason.

Years ago, my work password was “shithead.” I loved that one, until it expired and I was forced to change it.

[Mama_Zappa]

@andros

Except for the whole “precisely 8 characters” restriction, which is entirely inane.

At least they told you the 8 characters (well, 7 really).

I once spent several days trying to update a work-related password. Required number of numeric/alpha/upper/lower/special characters, minimum length 14… only when they said “at least” they really meant exactly 14. And not all special characters worked, and they didn’t say which ones would.