Industry


Ads by TechWords

See your link here


Subscribe to our e-mail newsletters
For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
More E-Mail Newsletters 
Sharky's picture
Sharky

Shark Tank

Not so much agile as fragile

IT pilot fish is testing a new Web site built using an agile methodology. And how's this new development style working out?

"I wanted to test a new feature added to the 'user profile' section," he says. "We had cleverly designed the user profile page to be password-protected, using the same password used to get into the site." 

Fish's password gets him into the Web site just fine. But it doesn't work when he tries to get to the user profile page. The system kicks back an error message informing him that he can't use a password containing anything but letters and numbers.

And fish's password contains an underscore character mdash, which the system was perfectly happy to accept when he created it.

No problem, fish figures, I'll just change the password to something the user profile page is happier with.

But he can't do that either. The page that will let him change his password won't accept the password that the Web site has already allowed him to create.

"Apparently our teams didn't design any standard requirements for passwords," grumbles fish. "They just built one password test to create your account, and a different password test for the user profile page.

"Oh, and did I mention that we have several other Web sites, each with password entry code already in place that could have been reused?"

Sharky's standard requirement is that you send me your true tale of IT life at sharky@computerworld.com. You'll get a stylish Shark shirt if I use it. Add your comments below, and read some great old tales in the Sharkives.

Now you can post your own stories of IT ridiculousness at Shark Bait. Join today and vent your IT frustrations to people who've been there, done that.

What People Are Saying

The Password Policy Notice that hangs over my desk...

Due to recent audit criticisms, our password policy has been altered to improve security.

The following password policy is effective immediately.

1. Each password must be at least 8 characters long. Passwords must not exceed 42 characters.

2. Each password must contain 2 non-sequential numeric characters with at least one alphabetic character separating them.

3. Each password must contain 2 non-sequential alphabetic characters with at least one numeric character separating them.

4. Each password must contain one Upper case and one lower case alphabetic character.

5. Each password must contain at least one Extended or High ASCII character to be typed by holding down the Alt key while dialing the ASCII key code on the key pad.

6. Each password must be typed using characters from alternate, non-contiguous keys on a standard keyboard while using the left hand only, thereby freeing the right hand to shade or shadow the keyboard to discourage observation.

7. The password must be in French.

An example password is @|Θ/3‡)t&%^oui. (Assuming you squint.)

The above password policy is on hold pending further complaints about our current policy.

AD

NEVER mess with the IT staff. They have the ability to ruin your day.

Ummm

OK, here's a dumb question from an unenlightened, non-programmer, systems and network engineer: Why in the world would you validate the complexity components of a password on a login screen? That seems pointless and stupid to me. It either matches or it doesn't. Shouldn't the validation be in the password change mechanism? And wouldn't that little tidbit of logic have prevented this problem from occurring in the first place?

I'll tell you why

OK, you want to know why complex passwords are demanded? About ten-twelve years ago, I worked for a company in which the Unix boxes all used NIS, which amounts to a single password file for all systems. Until I came, password security was not a concern -- there was no password expiration and anyone could pick his own.

Just after I got there, I installed a new HP server with a ton of RAM and fast disks. However, the application that it was to run was not ready, so I downloaded a program called crack from an internet site and ran it against the yppasswd file. crack is described at http://www.crypticide.com/alecm/security/c50-faq.html Basically, it tries to crack Unix passwords.

Well, out of the approximately 625 accounts, crack managed to get slightly over 400 passwords. This from a program which anyone can download.

Armed with these results, we had a very interesting meeting on password security.

Not what I said.

I've done similar. For anyone who doesn't think there are ways to crack NDS/eDIR passwords, I'm here to tell you that isn't true.

What I said was it's pointless and stupid to waste CPU cycles checking an existing password to make sure it meets complexity requirements when the user uses it to log in. The password has already been set and accepted by the system. The time to do the complexity check is when the user clicks "change password", before the system accepts and saves the new one.

If the two separate login processes in the story weren't both checking password complexity, each with a different set of requirements, but rather just checking what was typed in with what was saved in the system knowing that if the two matched then the complexity requirements were already met, the problem wouldn't have happened.

passwords

When I log into Lotus Notes, I'm asked if I'd like to make Lotus accept my domain password. I say yes, it says to type in that password, and it replies that the format of that password is not acceptable. However, it does not say what the required format is.

PW

I think the password is overblown in some cases. We have a manager that requires a 20 digit alpha/numeric type passwords, another wants to change the password every two weeks. I’m the bad IT guy that writes down the passwords on sticky notes on my PC. Sue me.

Limmerick - but not Ireland!

Somehwere on down the line,
John Robo is trying to opine,
It's not really BAD
In fact it's quite SAD
He's and IDIOT who thinks he's FINE!!!

I know flamers are out of season, but I couldn't resist......

Oh, boy . . .

I'd hate to be in your shoes, dude . . . ;-)

He's and IDIOT

*&^%$# fat fingers!!!!

I hate it when that happens! ;-)

Mea culpa

IDOIT

Besides, everyone knows it's spelled "IDOIT".