full-disclosure - guidelines for good password policy and maintenance / user centric identity with single passwords (or a small number at most over time)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4426E0EA.7000304@kallisti.se>
Date: Sun Mar 26 19:44:03 2006
From: hdw at kallisti.se (Anders B Jansson)
Subject: guidelines for good password
	policy	and	maintenance
	/ user centric identity with single passwords	(or	a small number at
	most over time)

James Longstreet wrote:
> 
> On Mar 26, 2006, at 12:12 PM, Anders B Jansson wrote:
> 
>> And even then they fail the actual user has a gun at his temple.
> 
> Frankly, this is true of just about any authentication scheme.

Exactly, so how far should you drive your requirements for an authentication scheme?

Pushing requirements to far will lead to weaker security and higher cost without any gain.

-- 
// hdw