or obscuring it as it is typed by using asterisks (*) or bullets (•). Allowing passwords of adequate length. (Some legacy operating systems, including early versions of Unix and Windows, limited passwords to an 8 character maximum, reducing security.) Requiring users to re-enter their password after a period of inactivity (a semi log-off policy). Enforcing a password policy to increase password strength and security. Assigning randomly chosen passwords. Requiring minimum password lengths. Some systems require characters from various character classes in a password—for example, "must have at least one uppercase and at least one lowercase letter". However, all-lowercase passwords are more secure per keystroke than mixed capitalization passwords. Employ a password blacklist to block the use of weak, easily guessed passwords Providing an alternative to keyboard entry (e.g., spoken passwords, or biometric identifiers). Requiring more than one authentication system, such as two-factor authentication (something a user has and something the user knows). Using encrypted tunnels or password-authenticated key agreement to prevent access to transmitted passwords via network attacks Limiting the number of allowed failures within a given time period (to prevent repeated password guessing). After the limit is reached, further attempts will fail (including correct password attempts) until the beginning of the next time period. However, this is vulnerable to a form of denial of service attack. Introducing a delay between password submission attempts to slow down automated password guessing programs. Some of the more stringent policy enforcement measures can pose a risk of alienating users, possibly decreasing security as a result. Password reuse It is common practice amongst computer users to reuse the same password on multiple sites. This presents a substantial security risk, because an attacker needs to only compromise a single site in order to gain access to other sites the victim uses. This problem is exacerbated by also reusing usernames, and by websites requiring email logins, as it makes it easier for an attacker to track a single user across multiple sites. Password reuse can be avoided or minimized by using mnemonic techniques, writing passwords down on paper, or using a password manager. It has been argued by Redmond researchers Dinei Florencio and Cormac Herley, together with Paul C. van Oorschot of Carleton University, Canada, that password reuse is inevitable, and that users should reuse passwords for low-security websites (which contain little personal data and no financial information, for example) and instead focus their efforts on