Re: AD and enforced password policies

[Tim Franklin <tim () pelican org>]

> There is indeed a difference between Europe (or is it only .SE?) and
> USA here; no bank in Sweden lets you login without at least a client
> certificate and password/pin code. Most banks have a hardware token,
> either challenge-response or HOTP/TOTP; some use the chip in chip-and-pin
> cards as certificate carrier, and combine it with a reader device to
> manage pin code entry.

Can't speak for Europe as a whole, but certainly in the UK it's not common - and I wish it was.  I do have different 
passwords for my banking and other finance-type sites (pensions etc), both for each site and distinct from my 
"fuzzykittens" passwords (which do re-use a handful of variations on a couple of themes).  A hardware token would be 
very nice though.

Client cert worries me a bit - while it *should* be standards-based, I'm sure there's some way to implement it such 
that it only works on Windows.  Given how long it took for banks to stop with the "Safari! Evil! Access denied!" 
routine, I don't hold much faith in their willingness or ability to build cross-platform solutions.

Grumble for the day: Santander, who require so many different IDs, logins, codes, reference numbers etc to access their 
on-line services with no indication at all of how any of them relate to the documentation previously sent or any 
changes made since, that there's no way to deal with it other than to write them down.  Oh, and some more different 
codes, with more different names, to access the same account by telephone.  Strongly not recommended.

Regards,
Tim.