🚀 go-pugleaf

In article <mumble>, dave@lacerta.unm.edu (Dave Grisham) writes:
|> Does any site lock accounts that their password guesser guesses? --grish
|> 

If our password guesser guesses a password, we send e-mail to the user
and strongly urge that they change the password immediately.  We give good
password guidelines in the message we send.  We check the password a
week later.  If it has not been changed we change the password for
them.  They can then go pick up their new password. (We have a system
that generates account information pages that are kept in a controlled
area and only given to the identifiable account owner.)  This doesn't
really constitute locking the account, but if a user ignores the
change password e-mail, they will discover one day that they can't
login until they go get their new password.

-- 
Joseph A. Watters, Jr.		jaw@owlnet.rice.edu
Deputy Director, Owlnet
Rice University
Houston, Texas

dave@lacerta.unm.edu (Dave Grisham) wrote:
>Does any site lock accounts that their password guesser guesses? --grish

If my guesser successfully breaks a user login, I send email to that user,
telling them to change their password; I also give a bit of guidance for
"good password selection".  

This continues until they pick a password that my guesser doesn't break.

If the user ignores several email messages AND doesn't change the password,
I lock the account; on login, they see a message that says (essentially) 
"to get your account back, come see XXXX in room XXXX".

[If the user goes one week without logging in after I've sent email, I
 feel that I must lock the account anyway.  I realize that many users
 do not check their email every day, but I feel that a week is adequate
 time to do so.]

As far as our policy goes, locking the account (ONLY after repeated 
requests to change the password) falls under "failure to follow the
directions of University staff acting in the performance of their 
duties."

--Wes

-- 
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu

In article <1992Oct28.154433.12770@ms.uky.edu> morgan@ms.uky.edu (Wes Morgan) writes:
>dave@lacerta.unm.edu (Dave Grisham) wrote:
>>Does any site lock accounts that their password guesser guesses? --grish
>
>If my guesser successfully breaks a user login, I send email to that user,
>telling them to change their password; I also give a bit of guidance for
>"good password selection".  
>
>This continues until they pick a password that my guesser doesn't break.
>

Our policy here is about the same except we send a combination of e-mail
and paper mail.  The first and third warnings are sent by e-mail.  The
second is paper mail.  If I crack the password a forth time, I change
the encrypted password to the date.  (We run crack once a week.)

-Paul Hubbard
 Occidental College