Hi -

Here are your password guidelines:

Passwords must contain at least:
Eight to fourteen characters (letters, numbers, and symbols)
Two numbers or symbols in the first eight characters
3 letters in the first eight characters
Five different characters

Passwords must not contain:
The following symbols: @, #, &
Doubled numbers or symbols (e.g., 99 or %%)
Words or names spelled forwards, backwards, or in a foreign language
A Social Security number in the first nine characters of the password
Words constructed with similar-looking number substitutions (e.g., 0 for O, $ = for S, 1=20 for i), as in: capta1nk1rk, mr5p0ck=20

I realize that you, whoever you are reading this, probably had nothing to do with coming up with these guidelines. But I just wanted to take a minute and point out how completely stupid they are, and perhaps you will be motivated to find whoever _did_ come up with them and staple his or her head to his or her desk.

Guidelines like these make idiots feel good because they seem very “secure.” But they are less secure, by a lot, because they require so much contorted password construction, so unlike your normal password construction, that you have to write the thing down in a Google document because you have no chance of remembering it along with the ten thousand _other_ passwords in retarded formats other “experts” have decided that you need.

So at the end of the day you have a very insecure system, far less secure than if you omitted the hardassed policy.

Short version: this isn’t the fucking Pentagon. Pretending that it is makes everyone LESS secure, not more.

Naturally this won’t change anything, but now I feel better.

Shane

Despite the tone of this letter, I am actually doing very well.