Security through annoyance

A close personal friend reports a bloody annoyance. The place where he works decided to tighten up its network security, by forcing all users to change their passwords every three months.

As usual, the system checks to make sure that you're not just switching to an old password; the result, of course, is that people will write down their new passwords and stick them on post-it notes, because as soon as they've learned to memorise one it'll be time to change it. Or they (like me) just fiddle with a tiny part of the password, incrementing a digit or similar.

Most security professionals I've discussed this with think that forced password retirement is far more trouble than it's worth, and if anything reduces security while increasing their workload.

That's bad enough. But my close personal friend's place of work is a Microsoft shop, and has doled out Windows Mobile phones for email and other uses. These have to have their ActiveSync passwords synchronised to the new passwords manually - every time you change your password, you need to put it into both the main system and the mobile.

Which itself is more than bad enough - secure passwords should have a mix of letters and digits, and making sure you get those right typing blind into a tiny keyboard where you have to switch modes for the numbers is an absolute usability nightmare.

But more than bad enough isn't as bad as it gets. My close personal friend had to change his password when he was away from the office - and his work phone was at the office, charging, where he'd left it over the weekend. The result was that after the mobile had tried to synch and failed a few times, the network decided that there had been too many failed attempts to log in and locked the account completely.

Lessons? You should never have to enter new passwords into more than one place. You should ensure users have an intrinsically secure password that they can memorise, and let them use it. Increase security through awareness, not annoyance.

Usability is a major part of security: without it, the systems don't work.