Open all hours

When I logged on at work today it informed me that I needed to change my password.

We probably all have this. Every month or 6 weeks or so it demands we change our passwords. The problem that I have is the various requirements put on this and the problems that changing passwords requires.

At work, for example, the password has to be a minimum of 8 characters long; must contain one upper-case letter, one lower-case letter and one number. Because of the frequency of change, I know of a number of people who simply use their name with a number tacked on the end, and increase the number each time they have to change it. Already the 'security requirements' have lead to an exposure to security lapses because so many people use their name... because the password changes so frequently.

Then we have another system for booking holidays. This requires a change of passwords every 15 logins. Awesome. Again, one upper-case letter, one lower-case letter, one number. Only this time the password has to be between 10 and 14 digits long, and also contain a 'special character' - <>?/+=*. Quite why this is necessary when the system only allows people to book holidays, quite no-one knows. Again, this is somewhat defeated by at least four of my colleagues who have a post-it note attached to their screen telling them their current passwords: the frequency with which they change means that they will almost certainly be remembering the wrong one.

Then there is the email account. Not only do you have to have the various combinations of letters, numbers etc.; but it will not let you register any password where any three consecutive letters are in the same order as three letters in your surname or given name; nor where any two numbers could be numbers from your date of birth. You also can't use a password remotely similar to any of the previous 12 passwords registered.

I have seven computer programs at work that require password logins. Each has a different set of requirements and a different frequency of change.

Any it shows - well over 60% of the calls to our IT helpdesk were people who had locked themselves out of one of the various systems and needed a password reset.

And this is even before we get onto external websites.

I have three different internet bank accounts.
Bank 1 requires:
First name
Surname
Postcode
Password
Mother's maiden name.

Bank 2 requires:
Sort-code
Account number
Password
Security question.

Bank 3 requires:
Login (not the sort-code or account number)
Email address
PIN (not card pin)
Password.

And then of course there are the various other websites which may require an email to log in, or a specific username, and all of them seem to apply different requirements with regard to password security.

It really does seem that in order to make systems as secure as possible they are actually making it so difficult so as to increase the risk of potential breaches. I remember when my mother first got a cash machine card; she had the PIN written in the back of a diary she carried in the purse because she couldn't for the life of her remember what it was otherwise.

And they say that using computers and mobiles is causing us to forget important numbers.