The current recommendation from U S CERT is 16 characters. We endorce 12, and require uppercase, lowercase, numbers, and special characters. See the notification we push by selecting "forgot password" at https://securemail.chicagonettech.com.

 

 

 

 

To stop the damage from compromised accounts you can also setup Declude and use the hijack plugin. This will stop mass emails from leaving your server after a password is hacked.

Now that SmarterMail 13 is out I wanted to bump up this topic.  It seems one of the target audiences for the new features is the semi-pro mail administrators like me.  Not people like Bruce who have probably forgotten more about mail servers and email delivery than I will ever know.  We provide a service to our customers - we charge almost nothing for it so we can't invest tons of time into it - and SmarterMail 13 helps us to do this without breaking the whole internet.  So I apologize to people like Bruce for not being as hard-core about mail server administration but this is the reality we live in.

 

So with all that said, we're still hoping to have the definition of a "strong" vs "weak" password in SmarterMail slightly redefined.  Keeping in mind that most of the end-users (the general layperson, not mail system administrators) do not understand / are not motivated / etc to ensure that their own passwords are crucially important, let's help them out a bit by allowing for pass phrases in addition to the current options for numbers, uppercase / lowercase, symbols, etc.  The only way to do that is by assigning a password weight based on various factors as mentioned above.

 

My original example holds true.  Currently in SmarterMail 13 with all those password strength options checked, this is legit:

 

Pa55word!

 

And this is not:

 

At lunch I like to eat 5 donuts

 

SmarterMail 13 is great that we now have a mechanism to help get stronger passwords out there - now all we need to do is define "strong" in a way that is actually strong and will actually be accepted by the general end-users.  A really long pass phrase with no numbers in it is still a pretty good password.

 

This idea was originally presented back when SM12 was out, and I'm still hoping we can get some consideration for it.  To review, the idea here is to add logic in the determination of what a strong password is.

 

There have been a number of heated debates about showing passwords in plain text - both in version 15 and a new one that's started in version 16.  Part of the reason those threads exist is because:

 

1) People tend to forget their password,

2) Increasing complexity requirements for passwords they're even more likely to forget it, and

3) In a multi-device world it's much easier to recover the existing password than to change it

 

I believe strongly that if people were able to use pass phrases that we'd see a reduction in people forgetting their passwords.  A pass phrase would be much longer in terms of character limit but may not adhere to other requirements such as capitalization, numbers, special characters, etc.

 

I'm not alone in this thinking.  There is a great discussion of this on StackExchange here:

https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase

 

And in that thread there's a great quote: