Talk:Password policy

message: Can management force you to share your personal password with your co-worker.
:Can they?  Probably; it's their company.  Should they? In other words, is it a reasonable security practice?  Certainly not. Petershank 05:01, 17 March 2007 (UTC)

message: Interesting question: given an unrestricted dictionary attack, how many extra tries does it take for the attacker if the password is changed on a regular basis?  And if anyone can find a cite for the answer, it would be good to see incorporated. Calum (talk) 15:53, 6 March 2009 (UTC)
replies: text: Assuming the change interval is large compared to the time the attacker is willing to spend on the search (say weeks or months), periodic changes should have no impact on the search. Periodic password changes only create an incentive for the attacker to use a recovered password immediately, say to install a back door or root kit. And there is anecdotal reason to believe that frequent changes encourage users to choose simpler passwords, making dictionary attacks more feasable.--agr (talk) 16:52, 6 March 2009 (UTC)
thread_title:  Password changing and dictionary attacks 

message: I was reverting IP vandalism when I ran across the deletion of the "environ" pattern password section. I am no expert on this topic, but the deletion reason was weak (I've never seen this) and a brief search gave me a reference which I included. Please feel free to message me or change my reversion if you can provide a reference demonstrating that the section is in error. Thanks TreacherousWays (talk) 19:43, 5 December 2011 (UTC)
replies: text: The supplied reference is the same text as the wikipedia article.  I don't know which came first - the wiki article, or the reference, but either way I'm not sure it's a valid reference.  I'm not disputing the existence of the environ password, but I do think the IP editor had a good point in removing at least the government bit.  Here in fact is a reference disputing the government claim.   a_man_alone (talk) 21:41, 5 December 2011 (UTC)
replies: text: The link you provided states (in part), "... It’s widely claimed on the web that employees of the UK Government are advised to use passwords of this form. Although I have seen this advice on a local government website in the past, I can’t find any current recommendation ..." I would say that in terms of verifiability, this may just be a non-starter. It would be counter-productive for any agency to confirm or even deny that their passwords have a specific pattern. Perhaps the best solution in this instance might be to note the claim (which is verifiable) rather than advance it as fact. TreacherousWays (talk) 15:07, 7 December 2011 (UTC)
thread_title:  Reverted "environ" deletion 

message: This would be a good addition to this article.
The preceding comment didn't include a link to Stanford's Password Policy. I found the following documents:
https://uit.stanford.edu/service/accounts/passwords/quickguide
https://uit.stanford.edu/service/accounts/passwords  — Preceding unsigned comment added by 59.148.176.172 (talk) 01:46, 4 September 2020 (UTC)
thread_title:  Stanford Password Policy 

message: They say "Verifiers should not impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for passwords."
So, you can't restrict the user from using a sequence of repeating characters like 'aaaaaaaa'.
But a bit later, they say mention checking against lists of commonly-used, expected, or compromised passwords, such as "Passwords consisting of repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’)".  — Preceding unsigned comment added by 2001:630:53:FB:64BD:85D5:B476:D73B (talk) 12:34, 18 November 2019 (UTC)
thread_title:  Conflicting NIST guidelines