The current version allows the admin to select the Strict Password policy:
The Strict Password Policy will enforce the following rules whenever a password is set:
Passwords must be at least 8 characters long
Passwords must contain:
- At least 1 uppercase letter
- At least 1 lowercase letter
- At least 1 number
- At least 1 special character (@,#,$,etc.)
We also have mechanisms in place to prevent brute force attacks against FogBugz via password-guessing. After a certain number of incorrect attempts, even a correct guess will not let you in until a period of time has elapsed. You can get the details from the code if you own FogBugz.
We don't pretend that these are enough for everyone ever in the history of the world. Security and authentication are always a moving target and needs are different depending on the data being secured. We find that our current authentication mechanism strikes a workable balance.
If these policies are insufficient for your organization, the next step is to restrict access to the FogBugz web site itself so that a user never even reaches the FogBugz web site/application, without having been authenticated to your satisfaction. Of course, this would require you to host FogBugz on your servers. Fortunately, those users who require stronger security than is built into FogBugz have mostly self-selected into FogBugz for Your Server anyway.
