Passwords

The Phone Call That Started This A client’s junior admin called me last month. Their company had just rolled out a new password policy — 14 characters, three character classes, rotation every 90 days — and the helpdesk was drowning in reset tickets. The admin was proud of the policy. The users were writing the new passwords on sticky notes stuck to their monitors. That is the entire password industry in one story: we keep making the rules harder without making the passwords better. ...