RE: Password complexity - improvement

I think you are arguing two different points here.

One is the number of possible passwords and the other is
negative impacts on security.

He is correct when he says it reduces the number of
passwords, but incorrect when he says it diminishes

In the example you give below, if all four aspects are
enforced, then the second password could not be used. This
does in fact "reduce the number of possible passwords".

Another example would be the difference between requiring
that a password be exactly 8 characters in length, and
allowing a password to be any length up to 8 characters.
The latter would allow for a lot more possible combinations,
but does not remove the fact that a 1 character password is
not nearly as secure.

Just my 2 cents.

John Wienand
Network Services Manager
BNA Software
O: 202-496-6001 C: 202 329-1095

Eric R IT3
(CVN75 To
CS-3)" "Ansgar -59cobalt-
<jackser@cv Wiechers" <bugtraq@xxxxxxxxxxxxxxxx>
l> cc
Sent by: <focus-ms@xxxxxxxxxxxxxxxx
listbounce@ m>
securityfoc Subject RE: Password complexity -

06:46 PM


You're absolutely wrong in your statement here. Enforcing
that MUST consist of uppercase letters, lowercase letter,
numbers AND
special characters INCREASES the total number of possible
which in turn has a positive impact on your security.

It is much harder to break a password of AaBb1! than aabb1!
The more
options there are that are enforced, the more complex the
The determining factor in this case would be how long or
short the
password lengths are.


-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
On Behalf Of Ansgar -59cobalt- Wiechers
Sent: Wednesday, August 15, 2007 2:39 PM
To: focus-ms@xxxxxxxxxxxxxxxxx
Subject: Re: Password complexity - improvement

On 2007-08-15 dubaisans dubai wrote:
Is there a way to improve the password complexity
requirements in
Windows 2000/2003 servers

The default will enforce 3 of the following 4 properties -
smallercase, numbers, special-characters.

Is there a way to enforce all 4 properties.

Enforcing passwords that MUST consist of uppercase letters,
letters, numbers AND special characters reduces the total
number of
possible passwords, which in consequence has a negative
impact on your

Ansgar Wiechers
"All vulnerabilities deserve a public fear period prior to
becoming available."
--Jason Coombs on Bugtraq

Relevant Pages

  • Re: Screensaver takes too much time to fade-out...
    ... I will provide a disclaimer up front that I work in the security field, but I design security protocols and OS security I learn from osmosis from my colleagues. ... Linux install is NOT as bad as say XP install where you can get owned DURING the install if you are connected. ... I am quite contrary on passwords and password strengths. ... First configure your local firewall so that all inbound ports are closed and only open those that you have evidence that you need (what local servers ARE you running? ...
  • Re: US Military bans HTML in emails
    ... Now the MIS departments has tightened security. ... You mean like requiring 6-character passwords to now be "complex"? ... the need for non-alpha characters. ... I assume here that the hacker has somehow obtained a backup tape ...
  • Re: OT: disabling APIs to prevent keystroke logging
    ... I have googled keylogging but there's a ton of info a mostly ads. ... I've dealt with security issues in my work as a software ... Researcher refutes Microsoft's account of hijacked Hotmail passwords ... passwords were obtained in a massive phishing attack. ...
  • RE: passwords in asp pages
    ... and using integrated security for connecting to the database- this will ... remove cleartext passwords from the files. ... grab the raw asp source from the server. ... to facilitate one-on-one interaction with one of our expert instructors. ...
  • Re: Oh Dear, Where to start?!
    ... > sort of security solution? ... > use, passwords, physical security, backup/disaster ... > admin, network admin, tech support, programming, and ... Theres lots of software out there for backups. ...