Why won't we help users create good passwords?

Sysadmin pilot fish at this bank gets a call from a veteran loan officer, who complains that he can't get signed on to the core banking system.

"This particular user was a serial offender at locking out his account, so after re-enabling the account I got connected, sharing the user session," says fish.

"I entered the temporary password I had just set for the account into the first field myself to ensure success, and then asked him to choose a new password and confirm it.

"After five rounds of rejected new passwords, re-entering the password and giving him another chance to choose an alternative, I patiently explained that our password-complexity requirements would not allow the password to have two numbers next to each other.

To read this article in full or to leave a comment, please click here