Re: Password complexity - improvement

On 2007-08-15 Adrian Marsden wrote:
> On Wed 8/15/2007 2:39 PM Ansgar -59cobalt- Wiechers wrote:
> > On 2007-08-15 dubaisans dubai wrote:
> > > Is there a way to improve the password complexity requirements in
> > > Windows 2000/2003 servers
> > >
> > > The default will enforce 3 of the following 4 properties -
> > > Uppercase, smallercase, numbers, special-characters.
> > >
> > > Is there a way to enforce all 4 properties.
> >
> > Enforcing passwords that MUST consist of uppercase letters, lowercase
> > letters, numbers AND special characters reduces the total number of
> > possible passwords, which in consequence has a negative impact on
> > your security.
>
> How?
>
> 26*26*10*(however many special characters you want to allow) > 26*26*10

That's true, but your basic assumption is wrong. I'm not talking about
passwords consisting of uppercase/lowercas letters, digits and special
characters compared to passwords consisting of uppercase/lowercase
letters and digits only. I'm talking about passwords that MUST consist
of uppercase/lowercase letters, digits AND special characters compared
to passwords that may consist of ANY combination of those characters
(even combinations that don't consist of characters from ALL groups).

Regards
Ansgar Wiechers
-- 
"The Mac OS X kernel should never panic because, when it does, it
seriously inconveniences the user."
--http://developer.apple.com/technotes/tn2004/tn2118.html