New York Times article on password security

rwmidl

This was in Saturday's NYT. A Strong Password Isn't the Stongest Security

dynamik

A lot of that is pretty common-sense and well-known. If someone can run code on your box, it's not yours anymore. Passwords are obviously going to be no help to you at that point.

I disagree with the no lockouts because of concerns over denial-of-service. People bring that up all the time, but I never see it or even hear of it happening. You also don't need to lock out an account for 24 hours. If you lock out an account for 5 minutes after 3 invalid attempts, you're still reducing the rate of guesses to 36 per hour, instead of hundreds or thousands per minute. Depending on what type of service this is, you could use something like Fail2ban to block IPs doing the guessing, so someone can't just load a tool up and have it perpetually lock out the account. I think the benefits outweigh the potential problems. However, you should always have a way to except accounts or disable the policy altogether in the unlikely event that something like that should occur.

I do like limiting the sequence of letters from previous passwords. People too often just increment the last number by one whenever their password expires. i.e. Password1, Password2, Password3, etc.

It really comes down to user education and awareness. Users can make stupid passwords that still satisfy complexity requirements. Password1 is a perfect example of this. That's an acceptable password for systems that require three of the four: lowercase, uppercase, numbers, and symbols, and it meets the common length requirement of 8 characters.