Passwords run our life nowadays.
We’ve become accustomed to password policies which have a minimum character limit (8 seems pretty standard), don’t let us have the same password as our username, don’t let the password be our name (depending on how much the system knows about you) and a host of other seemingly strange rules.
Most of these are in our best interest, your username can be public so don’t use that unless you want people to get into your account for example. Suggested rules tend to also be things like, don’t use your birthday, your child’s name, basically anything personal which can be guessed or mined out of your Facebook account.
Rules are important. but they should be to enhance security rather than limit it – Emma McCall, Security Consultant at A&O Corsaire
What companies do with your password can vary, at the very minimum it should be salted and then hashed (salted – have a word/phrase/random string added to it, hashed – turned into a garbage string which makes no sense to anyone, even you). Then when you try and login, your password attempt goes through the same process and is then confirmed against what the system has stored about you. This means that even if people broke into the system and got your password, they shouldn’t be able to do much with it since it is not stored in plain text (not stored as what you actually type in).
Virgin Media’s rules are slightly… off.
As said before, rules are supposed to enhance security. These don’t appear to. By making very complex rules, it makes them harder to remember, when they’re harder to remember, people either make them something to guess or they write them down. Also, the more rules you introduce, the fewer passwords hackers need to guess to crack through, so you’re actually doing hackers a favour by telling them what they don’t need to waste their time guessing!
Be sensible with your passwords, and if the rules don’t seem to help you be secure, question why they’re there at all.
Virgin Media have been asked about their policy but they haven’t got back to anyone.