A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

6
votes
1answer
95 views

First X characters of your password cannot be identical to your previous one

The security policy at my employer has a password rotation policy for my workstation. Upon a recent change of password I immediately received an email telling me of an issue: According to our ...
4
votes
1answer
131 views

Why, after a certain character limit, are larger passwords labeled as “weak” on some sites?

On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not. I've been noticing on some sites, that after x amount of ...
0
votes
3answers
70 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
0
votes
1answer
57 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
-4
votes
0answers
47 views

Why would a website have a maximum character limit on passwords? [duplicate]

I was just about to sign up for a website but the maximum password length was 10 but I can't think of a rational reason as to why a site would implement it that way. Can you guys think of anything?
1
vote
2answers
61 views

What policies and agreements regarding information security are a must have for every self respecting company?

I assume that it's a good idea to supply the users of a system (or employees) with policies and agreements regarding information security. What kind of documents should be considered? For example (...
2
votes
2answers
184 views

Is it better to choose less-vulnerable random password?

I have created a random password generator function (which can be found here if anyone wants a look), which will churn out passwords with a random mix of letters, numbers, and other characters. This ...
62
votes
5answers
5k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
0
votes
2answers
107 views

Secure password generation for different websites [duplicate]

I came up with the idea to generate passwords for internet sites by the following shema: $masterpassword $hostname $TLD hashfunction($TDL.$masterpassword.$hostname) So the actual password is a ...
8
votes
4answers
370 views

Is autocorrecting typos in passwords secure?

Technology Review's Why Autocorrect for Passwords is a Great Idea says: New research shows those frustrations could be avoided using the same approach used to fix typos in text messages and ...
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
64
votes
4answers
8k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. [&...
1
vote
3answers
88 views

Could these special characters be used in a password?

To use a good password, I was thinking about adding special characters. I remember that some login services don't allow all characters. Perhaps it depends also on the keyboard layout. Could these ...
33
votes
12answers
9k views

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
1
vote
1answer
48 views

Is there a functional difference between `chage -M 99999`and `chage -M -1`on Linux?

My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. ...
3
votes
5answers
537 views

How secure is changing or adding a single character in your passphrase?

I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their ...
10
votes
3answers
1k views

An authoritative source for why you should NEVER give your password to anyone?

I know this might be a bit subjective, but it's based on this popular question here. Hopefully this is acceptable. The problem with that question and answer is that I can't send it to my boss and ...
0
votes
0answers
37 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and Get-DhcpServerv4Scope....
0
votes
2answers
74 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
0
votes
1answer
57 views

What security policies and practices could one practice to safegaurd against being inebriated?

My passwords for the most part as well as access procedures I could do while inebriated/intoxicated. Be it a simple login/password login to email or VPN and accessing a database. This might sound ...
0
votes
0answers
51 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
2
votes
2answers
114 views

Are there any examples of huge damages done by password leaks, or bad password management policies? [closed]

Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their ...
1
vote
3answers
129 views

Why shouldn't I use an old password? [duplicate]

Some services like Google or Facebook forbid me to use a password that has already been use for the same account in the past. My question is, if this old password was never compromised (i.e it was ...
24
votes
5answers
1k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
1
vote
0answers
30 views

password aging, advantages and disadvantages [duplicate]

What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
11
votes
3answers
137 views

Reason to ban digits as first character in passwords?

When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far: At least 8 characters but no more than 13. Only usage of “valid” ...
8
votes
2answers
135 views

How can I enforce strong password policy with non-technical user base?

I've been using zxcvbn to enforce strong passwords for a service where break-ins would cause considerable problems. However, the service is only viable if many users sign up. We've found that users ...
4
votes
1answer
82 views

Is limiting/cutting password-length without notice insecure?

I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored. Does this make our linux system more ...
3
votes
3answers
190 views

Prevent password reusing across different sites

I'm generally against too strict or complex rules to accept passwords (rules like "It must contain at least one upper-case character, one number and one symbol" and things like that, see also XKCD #...
9
votes
2answers
288 views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
3
votes
1answer
103 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
3
votes
1answer
112 views

Is locally reusing a password a bad practice?

All my valuable data is in VeraCrypt volumes. The (very strong) keys of the volumes are stored in a single KeePass database, which uses a reasonably strong password. I want to encrypt my backups too, ...
4
votes
1answer
1k views

Why does ebay prohibit certain characters in password strings?

I had to change my ebay.com password today and, to my surprise, I was not allowed to use certain characters. For example [ results in an 'invalid' password and the system refuses to accept it. Is ...
-2
votes
3answers
338 views

Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's ...
1
vote
2answers
219 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
2
votes
0answers
145 views

Has password strength been an *actual* problem in a professional context? [closed]

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the Tr0ub4d0r&...
139
votes
16answers
18k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
0
votes
1answer
85 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
2
votes
2answers
241 views

Is this password inside a file secure? A security paradox

Preamble: I have been a long time lurker but first time poster to the Information Security site, so please be gentle with me. The Situation: I ran into a situation where I needed to securely store a ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
5
votes
1answer
126 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
1
vote
1answer
72 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
-1
votes
2answers
57 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
12
votes
4answers
1k views

Does an *additional* company-wide password offer any real security?

So, let's say a company has what could be referred to as an "access key". Each user has their own username and password, and there is an additional company-wide access key that people must input with ...
1
vote
4answers
266 views

Complex password rules - is there any sense?

Let us assume that our system is well designed and it limits the amount of login errors so that brute force attach on the user interface is not possible. Say after 5 failed logins for an account the ...
2
votes
2answers
147 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
3
votes
3answers
124 views

how is strength of password calculated from standard keyboard patterns?

In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. ...