Password Selection StrategiesThe le

Password Selection Strategies
The lesson from the two experiments just described (Tables 3.1 and 3.2) is that,
when not constrained, many users choose a password that is too short or too easy
to guess. At the other extreme, if users are assigned passwords consisting of eight
randomly selected printable characters, password cracking is effectively impossible.
But it would be almost as impossible for most users to remember their
passwords. Fortunately, even if we limit the password universe to strings of characters
that are reasonably memorable, the size of the universe is still too large to
permit practical cracking. Our goal, then, is to eliminate guessable passwords while
allowing the user to select a password that is memorable. Four basic techniques
are in use:
• User education
• Computer-generated passwords
• Reactive password checking
• Proactive password checking
Users can be told the importance of using hard-to-guess passwords and can be
provided with guidelines for selecting strong passwords. This user education strategy
is unlikely to succeed at most installations, particularly where there is a large
user population or a lot of turnover. Many users will simply ignore the guidelines.
Others may not be good judges of what is a strong password. For example, many
users (mistakenly) believe that reversing a word or capitalizing the last letter makes
a password unguessable.