DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma;
	h=message-id:date:from:user-agent:mime-version:to:cc:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	b=qbVULNO/BElSoXXmGwhSYzezQBNgqv8ew6E5IHX29zHOfV68NWoMp4ckD2at4zEpgq
	cvuZ5rZ4Ooq7nrxLQbBo6Nz19Yrd3VCKDkxbW2pHeSugAfPJJMQBSBaXDmsvgzFQ2UZL
	biDI5FPhd4XlCISwozlAlnALpYrc9w0df2GLk=
Message-ID: <4C5F19A9.8020907@gmail.com>
Date: Sun, 08 Aug 2010 22:55:05 +0200
From: Andrzej Zawadzki <zawadaa@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
	rv:1.9.1.10) Gecko/20100630 Lightning/1.0b1 Icedove/3.0.5
MIME-Version: 1.0
To: Tom Lane <tgl@sss.pgh.pa.us>
CC: Scott Marlowe <scott.marlowe@gmail.com>,
	Craig James <craig_james@emolecules.com>, pgsql-admin@postgresql.org
Subject: Re: password administration
References: <20100805200454.17A64632749@mail.postgresql.org>
	<4C5B1D25.2060906@emolecules.com>
	<AANLkTimHrExZUmtZeX4NNXx7XxDw0Gm2QRz=hViYmTHr@mail.gmail.com>
	<29695.1281041681@sss.pgh.pa.us>
In-Reply-To: <29695.1281041681@sss.pgh.pa.us>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 05.08.2010 22:54, Tom Lane wrote:
> Scott Marlowe <scott.marlowe@gmail.com> writes:
>   
>> On Thu, Aug 5, 2010 at 2:20 PM, Craig James <craig_james@emolecules.com> wrote:
>>     
>>> A better solution is to implement a password-strength algorithm and require
>>> people to select decent passwords to begin with.
>>>       
>   
>> Exactly.  If you allow simpler passwords that have to be changed you
>> get things like:
>>     
>   
>> ilovemywife22   md5: b845aec254d018d118fe52c46ee8c98c
>>     
>   
>> changed to
>>     
>   
>> ilovemywife23  md5: 8c2b59e4d961478e3a9d5bd94979f329
>>     
>   
>> You can't tell how close they are by the md5.  If you try to prevent
>> people from reusing similar passwords, then you have to store either
>> the previous passwords (bad security) or something like a soundex of
>> the previous password (also bad security.)
>>     
> A place I know but won't name has a policy of storing your last five
> passwords (hopefully in md5'd form, but I don't actually know that) and
> not letting you reuse those.  Of course this merely encourages people to
> use a cycle of six or so passwords, like something they can remember
> with one digit tagged on.
>   
Hi!
Such a policy is in force in my country (Poland) but only if system
contains personal data. (government law)
8 or more characters - 2 capital letters, 2 digits
And... sometimes this is pain in the... but we don't have a choice.

TIP: you don't need 6 passwords - just 2 - with different one character ;-)

-- 
Andrzej Zawadzki