A promising approach to improved pa

A promising approach to improved password security is a proactive password
checker. In this scheme, a user is allowed to select his or her own password. However,
at the time of selection, the system checks to see if the password is allowable
and, if not, rejects it. Such checkers are based on the philosophy that, with sufficient
guidance from the system, users can select memorable passwords from a fairly
large password space that are not likely to be guessed in a dictionary attack.
The trick with a proactive password checker is to strike a balance between
user acceptability and strength. If the system rejects too many passwords, users will
complain that it is too hard to select a password. If the system uses some simple
algorithm to define what is acceptable, this provides guidance to password crackers
to refine their guessing technique. In the remainder of this subsection, we look at
possible approaches to proactive password checking.
RULE ENFORCEMENT The first approach is a simple system for rule enforcement.
For example, the following rules could be enforced:
• All passwords must be at least eight characters long.
• In the first eight characters, the passwords must include at least one each of
uppercase, lowercase, numeric digits, and punctuation marks.