For the folks who don't know : I have moved job sectors and am back in government services again. Specifically I am maintaining the TLA stacks for the Army's NIPR (just read that as internet) connected istallations. As such I have many accounts (somewhere around 100) on many different computer systems. The Army has recently moved to a new password system that requires a 15 character password with 2 uppercase letters, 2 lower case letters, 2 numbers, and 2 special characters included. Further more most of these accounts require the passwords to be auto-generated and do not allow the user to change or set their own passwords. End result? 100 15 character passwords that are written down in the top drawer of my (and every other employee here) desk.

     Many of my co-workers actually maintain digital copies of these passwords in Excel as well and even email this back to their non-work email accounts for occasional telecommutes via VPN tunnel. In short the Army has garnered far more security vulnerabilities with this policy than it closed. Previously most accounts followed an 8 character rule and allowed users to set their own passwords. This usually meant that most accounts for one user used the same or similar passwords. If you got that one password you could do a lot of damage but the likelihood of compromise was greatly decreased since most users can remember one 8 character password.

     Now every cleaning-lady we have in here after hours automatically has access to thousands of individual accounts on critical DOD hardware. Brilliant.