I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangeling rules. Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issueing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

UPDATE: Two Factor Authentification is in general a good solution but will not work for us. We are a small compay and implementing Two Factor Authentification comes with relativly high initial costs.

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangling rules. Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issuing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

UPDATE: Two Factor Authentication is in general a good solution but will not work for us. We are a small company and implementing Two Factor Authentication comes with relatively high initial costs.

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangeling rules. Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issueing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did some auditing in a friends Company. There they had such a policy. I extracted the password hashes from their Active Directory and let john crack the passwords using mangeling rules. Many of the passwords were cracked when I choose to use a wordlist that was tailored to the company and its employees. They all used valid passwords according to the policy but using ones firstname, birth year and a random special char in the end isn't that secure.

Now I'm thinking about issueing a random password to every user that he can not change. The password would only be 10 digits long but wouldn't have any relation to the person which I think is much more secure. Do you think this is a good solution or am I missing something?

UPDATE: Two Factor Authentification is in general a good solution but will not work for us. We are a small compay and implementing Two Factor Authentification comes with relativly high initial costs.