Microsoft: Write down your passwords

Microsoft: Write down your passwords

Summary: Companies should not ban employees from writing down their passwords because it forces users to use the same weak term on many systems, according to a Microsoft security guru.Speaking on the opening day of the AusCERT conference on Australia's Gold Coast, Jesper Johansson, senior program manager for security policy at Microsoft, said the security industry had been giving out the wrong advice to users by telling them not to write down their passwords.

SHARE:
TOPICS: Security, Government
3
Companies should not ban employees from writing down their passwords because it forces users to use the same weak term on many systems, according to a Microsoft security guru.

Speaking on the opening day of the AusCERT conference on Australia's Gold Coast, Jesper Johansson, senior program manager for security policy at Microsoft, said the security industry had been giving out the wrong advice to users by telling them not to write down their passwords.

"How many have password policy that says under penalty of death you shall not write down your password?" asked Johansson, to which the majority of delegates raised their hands in agreement. "I claim that is absolutely wrong. I claim that password policy should say you should write down your password. I have 68 different passwords. If I am not allowed to write any of them down, guess what I am going to do? I am going to use the same password on every one of them," he said. 

According to Johansson, use of the same password reduces overall security.

"Since not all systems allow good passwords I am going to pick a really crappy one, use it everywhere and never change it. If I write them down and then protect the piece of paper -- or whatever it is I wrote them down on -- there is nothing wrong with that. That allows us to remember more passwords and better passwords," said Johansson.

Johansson said the security industry had been giving out the wrong advice about passwords for 20 years.

Delegates at the conference agreed that Johansson's advice made sense. However, they did not think it was practical.

One IT administrator from an international entertainment company, who requested anonymity, said that despite it being strict company policy to not make a note of passwords, he collated his personal passwords in an encrypted file because it "made more sense" than trying to remember multiple strong passwords.

Another delegate from a government agency, who also requested anonymity, said storing a password list in an encrypted file may work for the administrator, but it would not work for users because they would then forget the password to decrypt the password file.

The delegate said that even using two factor authentication -- such as an RSA token -- was not safe because people often write their pin number on a piece of paper and tape it to the back of the token.

"I know of a government minister that has done that," the delegate said.

Topics: Security, Government

Munir Kotadia

About Munir Kotadia

Munir first became involved with online publishing in 1998 when he joined ZDNet UK and later moved into print publishing as Chief Reporter for IT Week, part of ZDNet UK, a weekly trade newspaper targeted at Enterprise IT managers. He later moved back into online publishing as Senior News Reporter for ZDNet UK.

Munir was recognised as Australia's Best Technology Columnist at the 5th Annual Sun Microsystems IT Journalism Awards 2007. In the previous year he was named Best News Journalist at the Consensus IT Writers Awards.

He no longer uses his Commodore 64.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

3 comments
Log in or register to join the discussion
  • Real men use ssh public/private keys.
    nobody@...
  • I think that he is spot on.

    One of the things that you learn as an SA is that people will write them down, no matter what you say.

    The better approach is to accept this and then educate on *how* to write them down.

    eg sticking it to your keyboard is a bad idea.
    anonymous
  • My suggestion is to forget about passwords and all the complexity, use a passphrase, write it down if needed as it will look like a shopping list or similar. Use Caps etc if need to be...just an alternate suggestion unless 2 factor/biometrics is really an option for you
    anonymous