Mandated Password Rules / by kevin murray

If you use a computer, you will soon find that you are going to have to use passwords in order to access things such as subscription sites, financial sites, work sites, and email sites.  While it makes sense that your account should be unique to you and therefore that having a password associated with your account is a good way to make it so that other people, friend of foe, or phishing sites, or children, or whomever, do not have an easy way to gain access to your account, there are some basic problems attended to with password accounts.

 

For instance, different sites have different restrictions, to which those restrictions have changed over time, so that if previously your passwords were once six characters, now they have to be at least eight characters.  If previously you used all lowercase, now you have to use at least one character that is uppercase, and/or have one character that is not alphanumeric.  Additionally, as bad as those are in giving you the hope of consistently remembering your password for all the sites that you visit, the absolute worse are sites that either compel you to change your password every six months, or will not ever allow you to go back and use a password that you have previously used.  This means, if you are even a halfway busy person, you probably have multiple passwords for sites, with multiple rules, and while that might be good in the sense that you don't have one master password for all of your sites, it is both cumbersome and confusing for the user.

 

When it comes to passwords, most websites seem to have it all wrong, the password setup shouldn't really be to conform to whatever rules that they have, but should instead be something that is convenient for the user.  That is to say, if you as a user want to have stupid passwords, easily guessed at, that should be their choice.  Apparently too, many websites already keep track of the IP address that you have historically logged in from, and therefore it makes some sense to place some additional restrictions on access when that access point is different, by for example, having challenge questions. 

 

Also, when it comes to passwords and security, I'm somewhat surprised and dismayed that there are many websites that allow you to select or have preselected for you a box that keeps you signed in for two weeks, without having to enter your password again, often which is valid whether you later close your browser or not .  If you think about it, this should never be an option from a safety or privacy issue, since there are very few times when your computer is 100% under your control, unless you are the only one ever to have access to it.

 

Ultimately, because you do not go to every website every day, and because of the lack of commonality in regards to password rules and restrictions from site to site, you as a consumer, are forced to write down your particular password for particular websites, simply because there are too many to remember, and the consequences of not knowing your password will block you out of a website that you are trying to log into.  The fact then that your password is written down, does to a certain important extent, undermine a lot of why passwords are put into place to begin with.