From: Andrzej Zawadzki <zawadaa@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Scott Marlowe <scott.marlowe@gmail.com>
Cc: Craig James <craig_james@emolecules.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: password administration
Date: Sun, 08 Aug 2010 22:55:05 +0200
Message-ID: <4C5F19A9.8020907@gmail.com> (raw)
In-Reply-To: <29695.1281041681@sss.pgh.pa.us>
References: <20100805200454.17A64632749@mail.postgresql.org>
<4C5B1D25.2060906@emolecules.com>
<AANLkTimHrExZUmtZeX4NNXx7XxDw0Gm2QRz=hViYmTHr@mail.gmail.com>
<29695.1281041681@sss.pgh.pa.us>
On 05.08.2010 22:54, Tom Lane wrote:
> Scott Marlowe <scott.marlowe@gmail.com> writes:
>
>> On Thu, Aug 5, 2010 at 2:20 PM, Craig James <craig_james@emolecules.com> wrote:
>>
>>> A better solution is to implement a password-strength algorithm and require
>>> people to select decent passwords to begin with.
>>>
>
>> Exactly. If you allow simpler passwords that have to be changed you
>> get things like:
>>
>
>> ilovemywife22 md5: b845aec254d018d118fe52c46ee8c98c
>>
>
>> changed to
>>
>
>> ilovemywife23 md5: 8c2b59e4d961478e3a9d5bd94979f329
>>
>
>> You can't tell how close they are by the md5. If you try to prevent
>> people from reusing similar passwords, then you have to store either
>> the previous passwords (bad security) or something like a soundex of
>> the previous password (also bad security.)
>>
> A place I know but won't name has a policy of storing your last five
> passwords (hopefully in md5'd form, but I don't actually know that) and
> not letting you reuse those. Of course this merely encourages people to
> use a cycle of six or so passwords, like something they can remember
> with one digit tagged on.
>
Hi!
Such a policy is in force in my country (Poland) but only if system
contains personal data. (government law)
8 or more characters - 2 capital letters, 2 digits
And... sometimes this is pain in the... but we don't have a choice.
TIP: you don't need 6 passwords - just 2 - with different one character ;-)
--
Andrzej Zawadzki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: zawadaa@gmail.com, tgl@sss.pgh.pa.us, scott.marlowe@gmail.com, craig_james@emolecules.com
Subject: Re: password administration
In-Reply-To: <4C5F19A9.8020907@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox