Sunday, June 12, 2011

Curious Case #3: The Password Problem

With all the free work we had been doing to pay back our competitors it was time to actually make some money and I made sure to find work at my job for Charlie to come in at least once a week but in between I had asked Daryl the dispatcher to keep any eye out for any guaranteed money opportunities and that was how we ended up at the home of the CEO of a local Sports Shoe magnate who kept having problems logging into certain systems.

It took two days leading up to the visit working out the details with his Executive Assistant a fascinating lady named Sparkle Silverfox. I couldn't help asking how her parents came up with that name and she laughed explaining how they had named her Elizabeth Hamilton but she had changed it on her own back in the '70s. I should have known she was the old hippie and not her parents but she didn't look that old. We could tell she was the perfect fit for the equally eccentric CEO.

On the appointed Tuesday we were told the meeting would begin between at 1 PM but we already knew enough to expect a delay and spent the time waiting at a nearby Sandwich shop which was the only thing close to his secluded mansion hidden way up in the hills . While we waited I did battle with my favorite foot long meatball, while Charlie had to agonize over the entire menu before finally compromising with himself by ordering 6" each of Turkey and Tuna.

When we finally stood next to the CEO and watched him login for the first time we were surprised at how long it took to login. Charlie jumped right in saying "Whoa, what're you doing writing a book? No one should have a password that long, it's just too much typing. " The Chief Executive was indignant at first explaining how he had important data to protect and needed the strongest possible security.

I was starting to get uncomfortable but Charlie found a way of turning the tension into a learnable moment for all of us by explaining with complete sincerity that when it comes to passwords the strength is not in the length, but in the special characters and avoiding dictionary words. No one ever thought to question the big boss on how long his password should be but Charlie gave him the training he needed. We went on in detail how Passwords are used in different "namespaces" for example; LDAP for Windows, NIS for unix and sometimes a home grown web page will use a local list of people and passwords . That was the problem in this case when the program could not process that long password.

The discussion included a viewing of his own Company intranet web page for proper password management where it says the password must be exactly 8 characters. The Chief Exec was determined to change that policy so we knew we had to convince him once and for all that it wouldn’t matter anyway. We had him telnet to a terminal and forced him to type only the first 8 characters of his super long password and sure enough it let him login thereby proving that all those extra password characters were a waste of time.

The solution was simple, change the password one more time following the rules and things worked as expected and we went on our way. You can imagine my angry response later on when Daryl said the CEO refused to pay the bill since we didn't actually fix anything. Charlie didn't seem to mind and acted like it was no big deal while I took it as a personal insult until I found out later Charlie had a date with Sparkle Silverfox and that’s why he felt properly compensated.

No comments:

Post a Comment