I have to say that I loved his other post on the TSA's ridiculous password policy...
http://xato.net/passwords/worst-password-policy-ever
Their policy is:
1. Minimum password length is eight characters.
2. Passwords must contain at least one of each of the following: one alphabetic uppercase, one alphabetic lowercase, one numeric, and one special character.
3. Passwords shall not contain any two identical consecutive characters (example: 22apples, 14588904).
4. Passwords may contain no more than two identical consecutive characters in any position from the previous password.
5. Passwords shall not contain any dictionary word.
6. Passwords shall not contain any proper noun or the name of any person, pet, child, or fictional character.
7. Passwords shall not contain any employee serial number, Social Security number, birth date, phone number, or any information that could be readily guessed about the creator of the password.
8. Passwords shall not contain any simple pattern of letters or numbers, such as "qwerty" or "xyz123".
9. Passwords shall not be any word, noun, or name spelled backwards or appended with a single digit or with a two-digit "year" string, such as 98xyz123.
10. Pass phrases, if used in addition to or instead of passwords, should follow these same guidelines.
11. Passwords shall not be the same as the User
12. Password length will be selected to provide a level of protection commensurate to the value or sensitivity of the resources or data it protects, but not less than eight characters.
You just can't make this stuff up!
http://xato.net/passwords/worst-password-policy-ever
Their policy is:
1. Minimum password length is eight characters.
2. Passwords must contain at least one of each of the following: one alphabetic uppercase, one alphabetic lowercase, one numeric, and one special character.
3. Passwords shall not contain any two identical consecutive characters (example: 22apples, 14588904).
4. Passwords may contain no more than two identical consecutive characters in any position from the previous password.
5. Passwords shall not contain any dictionary word.
6. Passwords shall not contain any proper noun or the name of any person, pet, child, or fictional character.
7. Passwords shall not contain any employee serial number, Social Security number, birth date, phone number, or any information that could be readily guessed about the creator of the password.
8. Passwords shall not contain any simple pattern of letters or numbers, such as "qwerty" or "xyz123".
9. Passwords shall not be any word, noun, or name spelled backwards or appended with a single digit or with a two-digit "year" string, such as 98xyz123.
10. Pass phrases, if used in addition to or instead of passwords, should follow these same guidelines.
11. Passwords shall not be the same as the User
12. Password length will be selected to provide a level of protection commensurate to the value or sensitivity of the resources or data it protects, but not less than eight characters.
You just can't make this stuff up!