Creating a memorable password runs against most of the rules implemented for creating a strong password.  Much fine work has been done parodying this interesting fact.  That being said, the folks who implement the rules and subsequently announce those rules to the users have lost their minds.  Take a look at this description of the required rules I happened upon recently.

Let’s pair some of these.

Length:

Between 8 and 64 characters

Increase the length from 12-20 characters

Case:

Use both uppercase and lowercase letters.

A lowercase or uppercase letter

Repetition:

Not repeat any character more than 3 times in a row.

Not be a sequence of 4 characters in a row.

In each of the above pairs, the first line is all that is required to articulate the apparent rule.  The second line can be dropped as superfluous (and confusing).

In the length pair, the “increase” line is essentially unparsable.  This is to say I can formulate no meaning for that line which aligns that line with the other lines in a logically consistent fashion.  If the minimum is 8 then there would never be a reason to increase by 12.  If you are 20 away from 64 (the maximum) there is no reason to increase the length.

In the case pair, the and and the or cannot be conjoined.  If you must use both (and) then you cannot use one or the other (or).

In the repetition pair, if you cannot have three in a row you necessarily can’t have four in a row.  Further, if the minimum is 8 it must be longer than 4 regardless.

Then there is the order of the list.  Makes me wonder if that order could have been arrayed in a way that would be more confusing.  Could it?

Never mind that five lines are sentences (ending in periods) and the other three lines are not (unpunctuated).

It’s like they took a poll of the IT staff and just listed out selections from their various responses.

Just… think it through a bit.  UI/UX isn’t something that requires a specialized developer.  Think.

2024 Update

I came across this lovely gem of password instructions and wanted to share it as well.

Why limit a password to 18 characters?  That’s just plain silly.  It’s not even a power of two.  “Hey, let’s arbitrarily limit passwords!”.  Idiots.

Why restrict spaces?  Again, arbitrary and silly.

Both of these rules limit passwords making them less secure rather than more.  Stop it.  Just don’t.  Fix your shit.

Apparently Austalia is using IPv6.  Petty good for a backwater!

Have a look at this new exploit effecting at least Intel processors:

Intel CPUs impacted by new PortSmash side-channel vulnerability

Good times!

A user wrote in because they button they were using to show the Desktop was no longer present.  We all had a good laugh when we saw their attached image.

The problem was were all laughing for the wrong reason.

They were not in fact using the close button on a window to show the Desktop as the above may suggest.  No.  They were actually using the Show Desktop button at the far end of the Taskbar.  We should have been laughing at the oddness of the image.

Take a closer look.

In reality it is important to understand what the other is saying.  This will ensure that you are laughing for all the right reasons.

It was a remote system so it’s difficult to imagine what was happening over at that end but playing the logoff sound doesn’t usually take so long.

Shhh…

Here is the results of running the spell checker in SharePoint.

I spy with my little eye one misspelled word(s)!

Good luck.