OK, I'll have a take at it. A word of caution up front, though: we are a discussion forum. If you are genuinely interested in a discussion about security matters you are welcome whatever will make your stay here more enjoyable you may ask for. If, on the opposite, you think that just because you got some answer here you can use us as a free advertisement vehicle - think twice. You will be banned faster than you can spell "2FA" and we will close this thread after writing some rather negative comments about the business practices of your company (yes, we are well aware that you seem to represent a company - that is absolutely OK with us as long as you abide by the rules). These comments will stay here and will probably not have an advertising but rather the opposite effect. So, it is in your own as well as your companies interest that we get along fine.

Now, after this long introduction, lets get to the theme of the thread:

I think there are some misconceptions about "security" in general and UNIX/Linux security in particular. First, there is the "much helps much" misconception. If a 6-character password is good, then a 8-character password must be better. Or maybe would 12-characters be even better yet? And if changing the password regularly is good, wouldn't changing it more often be even better?

The usual outcome is: everybody needs to have a 12-character password with at least 7 special characters, one for every system and has to change it every other day, otherwise the account gets locked. This is so secure that it usually ends with most people having a piece of paper with their passwords under the keyboard - little unknown fact: nobody is able to memorise such password-monsters anew every second day.

Second: the "compliance"-fallacy. Instead of measuring "security" most often a system is tested to be "compliant" against some arbitrary standard, usually set forth by someone with no idea about the OS. I once had a customer who had a password rule that any password had to consist of at least three out of the four character classes: upper case, lower case, numbers, special chars.

Then they needed to audit and in the security standard it was declared that a "secure password" would consist of at least two of the character classes "upper case", "lower case" and "numbers". So, in fact they already had a system in place that guaranteed more complex passwords than were asked for. Guess what - this resulted in a "security finding" and they had to water down their rules to be "compliant". I leave it to the imagination of the reader if the purpose of security was served well with this.

Finally, and this is related to the first mentioned problem: if entering a password (or doing whatever else instead) is good, wouldn't be entering it twice be even better? When i log on to the customers site i work for right now, i have to enter: the password to log on to the client computer, then the passowrd again when i open the mail client, the the password again for the Jabber tool they are using. I might be mistaken but: let's suppose i obtained the password fraudulently - would entering the compromised password thrice instead of once slow me down in my criminal activity one bit?

bakunin