Complex password policies are stupid.

This is just my view on things, and I suspect I’m not the only one that thinks this way, but I should be free to choose whatever strength password I want. I am constantly frustrated by sites that force me to have a password of a given complexity. The example I came across this afternoon that fired me up enough to blog about it was the Australian Government’s GovDex (https://www.govdex.gov.au).

Your pasword on their site:

• Must not be the same as your current password
• Minimum length of 7 characters
• Contain at least one uppercase character
• Contain at least one numeric character

Now I would be ok if they made this as a suggestion. I may have also been OK with this is only one of them were required. But they are all required, and that makes it really annoying for me to pick a password. Shouldn’t I be the one to decide how secure I want my account to be? If I choose a simple password, surely that’s my perogative based on my interpretation of how importantly I need to protect my account?

Stepping back from the personal hardship here, doesn’t a restrictive list of criteria like this actually make a hackers job easier?

By taking these three required criteria:

• Minimum length of 7 characters
• Contain at least one uppercase character
• Contain at least one numeric character

My password bot now has a set of rules that will make it more efficient at finding a valid password by brute force. I can skip all alphanumeric combinations 6 characters or less and I can set rules to always include at least one uppercase and one numeric character.

I may be completely wrong about the hacking thing though – I’m definitely not a hacker and have never made a bot more complex than an auto-reply for IRC.

However, on the real-side of password seurity, because I have to think up such an obscure password, I’m probably not going to remember it which means I’ll just end up either writing it down somewhere, or my preferred option – just resetting my password every time I need to access a site. ;)

Regardless of how I end up managing these sites, one thing would make them better – let me decide on my password policy. It’s my stuff, my information and my reputation on the line if someone hacks my account. Let me choose my own destiny.