Passphrases
Passphrases have gained popularity in recent years as they can be more difficult to crack and easier to remember than passwords. The main difference between passwords and passphrases is their length. Passwords are rarely longer than 15 characters, but passphrases commonly contain 20 or more characters.
Complexity and dictionary checks are less important for passphrases as passphrases rely primarily on length for security. You may therefore want to relax some password policy requirements for passphrases. To configure a password policy with fewer requirements for passphrases:
- Click the desired policy in the right pane of the management console.
- Click Properties in the right pane of the management console.
- Click the Passphrases tab.
- Choose the minimum number of characters a password must contain before some rules are disabled from the drop-down list.
- Select the check boxes beside the rules that will be disabled.
- Click OK to close the Policy Properties page.
Disabled rules are not counted when calculating the compliance level. Consider the compliance level when deciding how many rules to disable unless you are using the default compliance level (all the rules).
|
Opinions differ on how long a passphrase needs to be. Even a 30 character passphrase can be weaker than a well chosen password. Do not disable too many rules under the assumption that length alone will make up for the reduced complexity as this is not always true.
|