Why is being honest such a pain?

[vaughnmr]

IT people that allow company systems with 10 different passwords required are the ones that need a new job. And password management is NOT a simple task, what with smartphones, internet, banking, forums, etc.

[Worldwalker]

Originally Posted by MikeFromHC

If Joe can't remember a sentence he made up then perhaps he needs a job someplace else.

Possibly true. But truth doesn't matter in comparison with the fact that Joe's in accounting (or human resources, or upper management, or anything, including dog-walking, which is treated as as higher than IT). You can dislike it all you like, but nobody's going to make the Joe in accounting remember his passwords. The Web is full of "my company's users suck" stories by IT people (some of them now unemployed) who have tried.

[Marcy]

Originally Posted by MikeFromHC

If Joe can't remember a sentence he made up then perhaps he needs a job someplace else.

Joe might remember the first one. But when you're forced to choose a new one every 3 months you start to forget. I have a good memory, but have a hard time remembering a password where I need to include at least 8 characters which includes at least one number and one non-alphanumeric character when I'm forced to change it every 3 months and can't repeat any of my prior passwords.

The reason phone numbers are 7 digits is because studies showed that is the longest string of numbers people could memorize easily. An 8 character password with more than just numbers is much harder to memorize.

And don't get me started on those reminder questions where you can't choose your own. They always ask things I don't have an answer to. What's your favorite actor? I don't have one. One actually wanted me to answer what my favorite candy bar was! Who has a favorite candy bar over the age of 10?

-Marcy

[MikeFromHC]

Originally Posted by Marcy

The reason phone numbers are 7 digits is because studies showed that is the longest string of numbers people could memorize easily. An 8 character password with more than just numbers is much harder to memorize.

-Marcy

Don't tell the people in Europe about the phone numbers where 8 is common.
Phone numbers are 7 digits in the USA because they grew to be that length out of necessity. It was not until the late 50's that most of the USA went from 6 to 7 digits

And don't get me started on those reminder questions where you can't choose your own. They always ask things I don't have an answer to. What's your favorite actor? I don't have one. One actually wanted me to answer what my favorite candy bar was! Who has a favorite candy bar over the age of 10?

The computer does not know that you gave the name of an object on your desk rather than the name of a candy bar.

[FizzyWater]

Originally Posted by vaughnmr

IT people that allow company systems with 10 different passwords required are the ones that need a new job. And password management is NOT a simple task, what with smartphones, internet, banking, forums, etc.

I'd be thrilled to have only 10 systems with separate passwords. I keep my password list in a password-protected Excel spreadsheet (kept on a drive assigned to my login, so only me or IT can get into it). I think the last time I looked, I had 48 different logins I have to keep track of.

[Worldwalker]

Originally Posted by Marcy

And don't get me started on those reminder questions where you can't choose your own.

I guess I'm not the only one who thinks they're stupid.

Seriously, they ask your place of birth, your mother's maiden name, the name of your pet ... in other words, all the things you should never use for a password. So you've got a strong password, and you're forced to use a laughably weak question that would allow someone to steal it. Am I missing something here?

[GreenMonkey]

Originally Posted by meromana

Of course, unless I was on a tight deadline, I didn't mind that much--I got paid by the hour, even when locked out and unable to do my job. I would guess that password problems cost this company far more than what they saved from any potential security threat that their policies may have prevented.

--Maria

There was a recent study that said exactly this. That the number of hours spent on IT support, password resets, and associated costs, outweighed the insistence on strong, regularly changed passwords. Along with the risk that people sticky-note them to their monitors or whatever.

[patrickt]

Most of the passwords I am required to have are not protecting anything important. For those, I have four variants of one alpha-numeric password. For critical sites, I have a unique password but, yes, I have the passwords on a CD.

I was not in IT but I was asked to get our new chief of police to set up passwords. I explained one was to keep outsiders out of our system. He thought and said, "Chief." I explained that should protect us well from kids in special ed. After we got a password there, I explained we needed one to keep our police officers out of his email or from sending emails from his account. Some more heavy thought and he gave me his wife's name. I came to the opinion that selecting passwords should be part of the test for hiring.

On the other hand, our IT department was buying a new systme that involved answers to fifty questions. Then, you would be asked the questions at random when logging on. Like no one would keep a list of answers handy.

I am curious, though. What does any of this have to do with honesty?

[Sweetpea]

Originally Posted by patrickt

I am curious, though. What does any of this have to do with honesty?

Well, if everbody were honest, we'd have no needs of passwords!

[patrickt]

Originally Posted by Sweetpea

Well, if everbody were honest, we'd have no needs of passwords!

That was it? Really? How bizarre. I was looking forward to a discussion about a downside for honesty but got whinging about passwords.

[Marcy]

Originally Posted by MikeFromHC

Don't tell the people in Europe about the phone numbers where 8 is common.
Phone numbers are 7 digits in the USA because they grew to be that length out of necessity. It was not until the late 50's that most of the USA went from 6 to 7 digits



The computer does not know that you gave the name of an object on your desk rather than the name of a candy bar.

I read the 7 digit thing just recently. I believe it was in one of Malcolm Gladwell's books. My grandparents phone number was always 7 digits from the early 40s on. They still had the same number (NE4-3510) until my grandmother died in 2003.

The computer doesn't know it, and 2 months later when I need it, I don't remember it either. Tell me what possible good that does? If I put a sticky up reminding me "My favorite candy bar is stapler" how is that any better than one saying "My password is U7d8e43d&je"?? Wouldn't it be better to let me create my own question that I can make as obscure as possible yet it will be something I always know the answer to?

-Marcy

[bjones6416]

Originally Posted by DuncanWatson

That problem relates to IT departments mandating 90 day changes of passwords with no repeats for the last 10 passwords and a mandate of 90% change for the new password as compared to the last 10 used. As well as mixed numbers, letters and punctuation.

Yes! All of those rules were in place for all of my passwords in the govt job I just retired from, and I had...let me count...NINE different accounts in use on a daily basis. Sometimes I would try to use the same one for several different accounts, but they eventually get out of sync when you have incidents of being locked out and having to reset your password earlier than the 90 day limit. Yes, I resorted to keeping them on a piece of paper in my wallet, which I know is a bad idea, but better than one of my co-workers who eventually just gave up and kept his in his Rolodex. I didn't mind the 90 day changes, but the rule about not being able to re-use any of the last 10 passwords made it completely unmanageable without resorting to keeping it written down somewhere.

[susan_cassidy]

The online accounts that will not let you use things like underscores, and won't even let you use over 8 characters are the ones that really fry me. Who writes this cr** software? That's right up there with the one-inch line on physical forms that want a full street address, with city and state.

[Daephex]

One of my minor hobbies is signing famous dead people's names when I am asked for a signature on something like a returned item, store card application, etc. It's funny to sign as Elvis Presley or Charlie Chaplin, and trying to keep a straight face.

I've never had ANYONE notice.

[MrPLD]

I always considered the whole 'change passwords' mandated policy actually reduced security due to a lot more people forgetting their passwords, calling up for them to be reset etc etc, which leaves open a few more opportunities to catch the new password via phone sniffing, email sniffing etc.

Personally I tend to use good strength passwords, unique for each site and hope they don't need changing in a looooong time. Remember too that most sites will be storing your passwords in a clear-text form in their DBs, more reason to use unique passwords.

I do still keep my passwords on paper locked in a safe, for the sake of my family if something happens to me.

Paul