On Thu, Jul 30, 2009 at 1:16 PM, Charlot, Firmin<[log in to unmask]> wrote:
> Hello all,
>
> We are re-evaluating our password requirements and wondered what others are
> using on their network.
>
> For example:
>
> What is the required password length?

I've been told that a minimum of 8 characters is common (3 trillion
combinations of just [a-z0-9])

>
> Is complexity turned on?

Complexity is an odd option (windows?)  We use cracklib (on linux) to
run dictionary checks on user paswords when they go to change them.  I
woudl recommend something similar (you don't want users to choose
dictionary passwords is the basic premise here).

> How often do people have to change their passwords?

Once a year

>
> Can old passwords be recycled? If so, how old must they do?

Your new password cannot equal your current password; I'm not sure how
useful remembering old passwords is.  I imagine it would encourage a
class of users to (pre/post)fix their current password with something
or increment/decrement it in order to keep it easy for themselves.
Certainly it seems useful to prevent users from using a small rotation
of passwords; but sadly most password changing systems tend to not
tell the user what passwords they have used in the past and so when it
comes time to pick a new one it is a frustrating experience.

Eg. They try password one, the system tells them not to use an old
password.  They try password two, the system tells them not to use an
old password.  They try password three, the system tells them the
password is not complex enough.  They give up and append a z to their
current password (or similar).  It would be nice if the UI just said.
"Pick a new password, it cannot be any of your old passwords and here
they are 'foo' 'blar' baz'."

>
> Any other requirements that you are using that are not mentioned above would
> helpful as well.

We have a blacklisted set of passwords that we disallow users to use.
Things like the company name, the users name, the users username, and
a set of random well-known default passwords we have used in the past.
 We have a custom check for these.

>
> Thanks.
>
>
>
> Firm.
>
>
>
>