Re: Password creating Theories

[ework0 <ework0 () gmail com>]

Glenn English wrote:

> On Fri, 2005-11-11 at 16:27 -0500, Jennifer Fountain wrote:
>  
>
> > I am currently coming up with a new policy to create root/admin
> > passwords for windows and linux boxes and would like to know your
> > thoughts on the methods you use to create them.  Thanks for any input!
> >    
>
> I ask the person who's password is being created to tell me the second
> line of a favorite song, then use the first letters of the line, using
> numerals where possible and including any punctuation. It's easy for
> that person to remember, harder for someone else, and not subject to
> dictionary attacks.
>
>  
A better approach is validate the passwords instead of apply methods to 
generate them. An intruder can find out what's your method and perform 
selective brute force cracking.

Let the user choose the passwords following some basic rules, for 
example, at least 6 characters, combination of numbers and letters, and 
so on....