次の方法で共有

Your Password is Too Secure

  • [アーティクル]

For obvious reasons, Microsoft employees are asked to refrain from bashing other teams or products in their blog posts. But with the dismantling of the Money product line a couple years ago, I feel the statute of limitations has expired and I can share a useful lesson.

At one point, I changed the password for my bank, and then went in to update the corresponding password in Microsoft Money so I could continue to download statements. Unfortunately, upon entering the password, I was met with this error box.

Here is a product, which is charged with protecting my most important data, and it is telling me that it can't accept a password which any typical computer-savvy user would consider a normal "strong" password. After seeing this message, my brain stopped working. If anything, a product which deals with access to someone's money should favor the uber-paranoid side of the security fence. But here was a product that actually limits a password's complexity and forced users to a weak one.

I can understand reasonable limits on length as there may be storage or processing concerns (I've run into web sites where an eight-character password was too long, and no, that is not a reasonable limit). But if you are working on the password-processing feature of your software, gimping a password's strength is something that should be avoided at all costs.

As an aside, you can use this utility to help gauge whether or not your password is strong.

Comments

  • Anonymous
    September 13, 2011
    Weak = Bad, storing passwords in plain-text = Worse.

  • Anonymous
    September 13, 2011
    Weak = Bad, storing or transmitting passwords in plain-text = Worse.

  • Anonymous
    September 13, 2011
    Special characters can give a false sense of strong. Http://m.xkcd.com/936