OptimalCynic

Discuss

What's the worst password policy you've seen? Bonus points if it's at your own organisation.

For me, it's Centrelink Business - the Australian government's portal for business who need to interact with people on government payments. For example, if you're disabled and pay your power bill by automatic deduction from your pension payment, the power company will use Centrelink Business to manage that.

The power company's account with Centrelink will have this password policy:

• Must contain a minimum of five characters and a maximum of eight characters;
• Must include at least one letter (a-z, A-Z) and one number (0-9);
• Cannot be reused for eight generations;
• Must have a minimum of 24 ho