Chasing the Wind

Help me. I can no longer remember my passwords. I’m about to go back to writing them on little yellow stickies and putting them on my monitor again.

It’s the rules. The rules for creating passwords are too complex; what’s worse, the rules vary from place to place. I used to try to keep them all synchronized; then I started attaching numbers at the end everytime it was time to change my password again. If my original password was “friday,” next month would be “friday1.”

Then some of the passwords had to contain a number, then a capitalized letter, then it couldn’t match previous passwords… next thing I knew, I had passwords like “grs83jNAs49n28n” and after typing that in 3 times in a row I was locked out of the system.

Here’s what I put up with today. To login to my company’s intranet, here are the new rules:

• Should contain 8 characters.
• Should not include any special characters such as -,+, / and cannot begin with a ! or a ?.
• Should not include an obvious combination of characters:
• No initials,
• No repetitive patterns (3 alpha charcters, 3 numeric characters),
• No birth dates,
• No Social Security numbers,
• No phone numbers,
• No account numbers,
• No dictionary words, etc.
• Should contain an uppercase alpha character, along with lower case alpha characters and at least 2 numeric characters.
• Cannot begin with spaces (first 3 characters) or the first three characters of the user’s name.
• Should not have numeric characters at the start or end.

The system will maintain a table of words that CANNOT be used as part of passwords. This list will be updated as deemed necessary.

Following these rules ensures you have created a password that is original, unique and strong (something known only to you and not easily guessed).

I’ll say. My eyes glaze over just reading the rules. But then once I login, I have to use another server, and it has a complete different set of rules:

Each password shall consist of eight or more alphanumeric or special characters in a combination that is not obvious (no initials, repetitive patterns, birth dates, Social Security numbers, phone numbers, account numbers, dictionary words etc.). It is required at a minimum that each password contains an uppercase alpha character, along with lower case alpha characters and at least 2 numeric or special characters.

The following special characters cannot be used in passwords: @ # % ^ \: ; ” ? /

Well, sure, some of the rules are the same. Some of them are different which is where the problem creeps in. And then one forces me to change my password every 30 days, the other one every 90 days. Eventually I’ll have to change it every 15 minutes.

Help me.