1991-06-16|Integrated password/PIN Security System
To Bell-Northern Research
The UNIX Security presentation at the WGA meeting triggered my thoughts on the general BNR data security. This COCOS is meant to stimulate discussions on the password/PIN issue, which can be summarised into the following bottom-line question.
Q. Which is better for BNR??
option 1: multiple crackable passwords? (e.g. see list attached)
option 2: single uncrackable password? (e.g. "Ya%e6q$a")
I raised quite a stink when the APOLLO registry password aging was proposed last year. I insisted that the policy not be implemented until the system to propagate the same password to multiple LAN segments is in place. I also complained bitterly to the BNR Internet Systems when I found out recently that "bnrgate" does its own password checking and my YP password which worked okay for workstations was declared crackable by "bnrgate", resulting in a 24-hour delay for an anonymous ftp session requested by my customer.
I totally agree with the philosophy of having people set passwords to difficult-to-guess one, as explained in the recent WGA meeting and also by the "bnrgate" administrator. However, my brain is bound by human intellectual limits, and the struggle for tradeoff between memorisability and mental health and welfare jeopardises my already stressed-out BNR worklife. I asked myself "How many passwords and PINs do I have to constantly update and remember?", and the list is simply staggering, as shown attached.
Now, instead of making endless complaints, I would like to make a constructive suggestion and propose an integrated BNR security facility to set a single BNR password/PIN with consistent aging for anything to with the corporation. Technically, it is almost possible now by the privileged SETPW/CHPASS command to some extent, and the NIS (YP) password is a candidate for the universal BNR password/PIN. The system should run an intelligent algorithm for crackability validation in real time when the user enters the new password. Even though it may consume some CPU time, the effect is offset by the fact that it has to be done once, not 16 times in my example below. It would also encourage BNR employees to set uncrackable ones, and at the same time minimise the uncontrolled proliferation of passwords and PINs within BNR.
passwords to remember at work ::::::::::: password/PIN examples
Meridian voice mail ..................... 19916 (must change regularly)
IBM VMID SUNATORI at BNRCARL ............ SUN-6 (must change regularly)
IBM VMID LIBSTAT at BNRCARL ............. LIB-6 (must change regularly)
