Re: Password creating Theories

[Chris Umphress <umphress () gmail com>]

On 11/15/05, Glenn English <ghe () slsware com> wrote:
> On Fri, 2005-11-11 at 16:27 -0500, Jennifer Fountain wrote:
> > I am currently coming up with a new policy to create root/admin
> > passwords for windows and linux boxes and would like to know your
> > thoughts on the methods you use to create them.  Thanks for any input!
>
> I ask the person who's password is being created to tell me the second
> line of a favorite song, then use the first letters of the line, using
> numerals where possible and including any punctuation. It's easy for
> that person to remember, harder for someone else, and not subject to
> dictionary attacks.

I also favor old mailing addresses, phone numbers, or initials from
other easy-to-remember information for the user. Combine it, '13371fy'
it, and you have a half-way decent password.

Of course, this makes for a hard-to-impliment policy, but it works
great for security.

--
Chris Umphress <http://daga.dyndns.org/>