Password Security and Draconian restrictions
I don’t have any research to back this up, but I bet it’s out there somewhere. We live in a world where the average computer user probably has at least 5 different “accounts” that require that user to have a password. I’d be willing to bet that most of them have between 10 and 20 such accounts. Some of these accounts are going to require the user to occasionally change that password, no two accounts, it seems, do this at the same time. I think there are laws against it. These laws were developed by people who hate sanity and happiness.
So we’re left in a situation where a person could potentially have to remember 20 different passwords at the same time. The best security, of course, would be to have a different password for each different account, each of which follows the conventional rules of password security, and all of which are changed on a regular basis. But for the user who has 20 different accounts, that means remembering 20 apparently random strings of 8 or more characters, and is beyond the abilities of most people I know.
Have you ever sat at a website, trying to log in, but unable to remember what your password was? I know I have.
Most people get around this problem in one of the following ways, or a combination of both:
1)They use weak passwords. Weak passwords, such as dictionary words or names, are easier to remember than strong passwords that resemble something like this Jlw#s2Ml&.
2)When the mandatory password changes come around, they cycle through a short list of passwords, and do their best to change all their passwords whenever they have to change one, keeping all accounts on the same password, and cycling through 4-6 strong passwords.
This second method is, in my mind, the better way of doing it. Ultimately, if you use a strong password, the second way should be fairly sufficient. Unfortunately, some organizations require you to use a unique password each time you change it, keeping a history of old passwords. These organizations also tend to be the ones that require password changes the most frequently, as much as every 2 or 3 months.
I happen to have an account with such an organization, and to be honest, it’s one of the biggest pains in my butt ever. To reduce the craziness that would ensue from changing 50 or so passwords every 3 months, I don’t keep that account in sync with other accounts, but because of this, I have to keep the password recorded somewhere to reduce the number of times I have to call the stupid helpdesk to have the password reset, thereby reducing the security of my account.
It seems that by being so draconian regarding the creation and changing of passwords, they are being counter productive, resulting in poorer security than there would be if they relaxed a little bit. If they allowed passwords to be reused after a certain amount of time, or a certain number of uses, for example, I’d be able to treat this account like every other account I have, and I wouldn’t need to write the password down in order to make sure I knew what it was.