Stupid windows password screen!

[DaveB]

I think its set at a corporate policy level by domain controller. The most painful is when they expire after 8 weeks and you choose a new one and it cannot be one used previously and cannot follow patterns like 1234 etc etc. I have had to write down passwords FFS !

There is an argument that says that writing down passwords is actually ok, provided you protect the password itself. It actually means people are more willing to use strong / complex passwords as they don't have to worry about remembering them.

This is why password vault apps for phones etc are so popular.

[_V_]

Chane your password every morning to the current date, put it through a hash.

So today's password is 62d815fd6cf414e69c2c612849265610

[Sysman]

The default is 8 symbols length with complexity (3 out of 4 upper case, lower case, number, symbol). Password1 fulfils the default requirements if the default length is changed to the more popular 12 - Password12345 is your friend

My favourite is P@ssw0rd.

That's a complexity score of 4 out of 4. Just keep going with abcd or 1234 for the required length.

[Sysman]

The other thing I don't get is people who update one work password, but not all the others, so they end up with a piece of paper containing their 10 different work passwords.

One reason is where different applications or internal web sites have different password requirements. At one place the mainframe timesheet web interface only accepted an 8 digit number.

[woohoo]

I use keepass, it can generate passwords for you if you want.

[unixman]

Won't let me set a password because it doesn't meet the requirements (length, complexity, etc) but won't tell me what the requirements are.

Ugh. This is one of those paper cuts that makes you think "why... how could this happen... how could such a crass bug make it through to release...".

XKCD passwords are the best (https://xkcd.com/936/). I use 'em for all me Internet things. Maybe.

[LondonManc]

Write them down at home and keep them somewhere away from your PC. Burglars will be after your kit, not your IPR (my NAS with copies of important docs is in a separate room to the PC).

Bit different at work where you can simply keep a password-protected spreadsheet and just need to remember the one password if SSO is not implemented.

[unixman]

I use keepass, it can generate passwords for you if you want.

Whs. Or keypassx as it is known on the Unix side of the fence.

[stek]

At BT on NHS Spine once, Windows team got it in the neck for weak passwords, so they issued us with 24 character ones, no dictionary words, upper/lowercase, numbers and punctuation.

Was no problem though since we all had them on post-it's under our keyboards. So much for security........

[d000hg]

Is that actually too insecure though? If someone has to physically steal it from your desk... and only people who work there know that's what you do?