Why not let the administrator decide? [LWN.net]

Why not let the administrator decide?

Posted Aug 12, 2026 17:37 UTC (Wed) by Wol (subscriber, #4433)
In reply to: Why not let the administrator decide? by rgmoore
Parent article: Changes in shadow-utils password-expiration features

> which means the kinds of passwords people are willing and able to memorize just aren't up to the task.

??? My company mandates a minimum length of 16 characters, which in me at least inspires some creative (and easy to remember) passwords.

"OwlDollyClipperForTwo"

I think that would be rather difficult for a computer to crack? And even for somebody who knows me, well the owl is obvious, Dolly is our cat, and then the train of thought goes veering off deeply into Edward Lear or Lewis Carroll country. Dead easy for me to remember, five random words stuck together makes it hard for a computer, and even for a good social engineering attack it's wandered seriously off track after the first two words ...

As for my real password at work, my biggest problem isn't remembering it, it's not making silly typos half way through!

(I'm not using this as an argument against defence in depth, though ...)

Cheers,
Wol

to post comments

Why not let the administrator decide?

Posted Aug 12, 2026 20:33 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link] (1 responses)

My company mandates a minimum length of 16 characters, which in me at least inspires some creative (and easy to remember) passwords.

I agree there are some ways of making longer passwords that are still easy to remember. For example, my work password expresses just what I think of my employer's password policy, which makes it easier to remember when it's time to type it. The problem is with the "in me at least" part, because you have to get everyone on board for it to work. Getting into a system is a weakest link type of thing, so it only takes a few people who pick easy passwords to undo the benefits of whatever clever password policy you choose. Meanwhile, 2FA gives you better security than most of the passwords real users are likely to pick and resistance to other kinds of attacks, like phishing. Oh, and users can't easily bypass the need for 2FA the same way they can undermine strong password policies.

Why not let the administrator decide?

Posted Aug 12, 2026 21:22 UTC (Wed) by mfuzzey (subscriber, #57966) [Link]

>my work password expresses just what I think of my employer's password policy,

Sounds like we have the same password :)

Why not let the administrator decide?

Posted Aug 12, 2026 21:15 UTC (Wed) by dskoll (subscriber, #1630) [Link]

My personal password rule is: My login password must begin with /.

Can you figure out why? 🙂

I once typed the password into what I thought was a locked screen but was actually an IRC client. Thankfully, most chat programs have continued the tradition of using / to start a command.

Why not let the administrator decide?

Posted Aug 13, 2026 8:56 UTC (Thu) by farnz (subscriber, #17727) [Link]

That's roughly 100 bits of entropy - all 5 words in your password are in /usr/share/dict/words on my system, and that file has a bit under 2¹⁹ entries, plus adding a few bits to allow for the fact that capitalized dictionary words is not the only option here.