Unlearned lessons

[unixronin]

Today's User Friendly strip makes a security point I've commented on myself many a time:  If you make your password policy demanding enough, you can force all of your users to write their passwords down, and the odds are at least some of them will leave their password notes where they can be seen and/or found by someone who shouldn't have them.  At which point your carefully crafted password policy, proof against any but the most massive distributed brute-force attack, becomes vulnerable to the pizza boy who happens to glance at the receptionist's desk while chatting her up on his way through the front lobby.

Comments

and now the smart card...

[jilara.livejournal.com]

We now have a smart card built into our badge that can be used to log into the system in lieu of password. And of course, the first week I had it, I left it in the system when I went home... (I now log in the old way, with user ID and password, since that's still allowed.)