A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

12
votes
4answers
2k views

Are single case alphanumeric passwords the most user friendly?

We are often advised, or required, to compose passwords containing all of the following: numerals, lower case letters, upper case letters and some special characters. In my view this is not the best ...
3
votes
3answers
184 views

Is it ok for software to store passwords locally in plain-text?

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different. I use a piece of open-source (see below) software for playing ...
1
vote
1answer
72 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...
5
votes
2answers
268 views

Does a random set of secondary passwords add any security?

My bank uses this rather uncommon policy of authentication. They of course have a password, which has quite strong password patterns like "use alphanumeric characters and symbols, 8+ characters" are ...
28
votes
4answers
2k views

New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization ...
5
votes
3answers
156 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
28
votes
4answers
3k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
3
votes
2answers
201 views

Are weak passwords acceptable for internal development?

We have a number of internal development environments that use weak passwords in the Auth and SQL components; particularly using passwords such as "password" or "Password1". These are obviously ...
-1
votes
1answer
76 views

Does the order of characters in a password matter to its security?

We all know a password should contain a healthy mixture of letters (upper and lower), numbers, and special characters. But does the randomness of their placement matter. Of course for letters it ...
1
vote
4answers
171 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
1
vote
1answer
38 views

Importance of password strength with secure element?

Greetings SE security community. Background: I have a number of items like certificates, databases, and encrypted file systems that require private keys. In order to avoid having duplicates of these ...
4
votes
3answers
145 views

What implementations are possible for dual control?

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one ...
2
votes
1answer
76 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
2
votes
2answers
93 views

Password reset system code system vs long hash

I'm building a password reset system at the moment and I've come across a dilema. Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
11
votes
7answers
761 views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
4
votes
2answers
61 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
19
votes
4answers
3k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
1
vote
0answers
88 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
0
votes
0answers
45 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...
0
votes
2answers
82 views

Enforcing password change

When a site gets hacked, or otherwise, the web site forces you to change your password. This is done by simply telling you to change your password, not enforcing it. Why do they do that? For ...
1
vote
3answers
109 views

Is it possible to have a high confidence that a password is not being reused?

Have a few thoughts on the topic, but the general gist is if a user inputs a new password, is it possible to have a high confidence that a password is not being reused elsewhere? By elsewhere, I mean ...
171
votes
7answers
37k views

Why would you not permit Q or Z in passwords?

Jetblue's password requirements specify that, among other stringent requirements: Cannot contain a Q or Z I can't fathom a logical reason for this, unless it were say, extremely common for the ...
8
votes
3answers
1k views

Logging “password with counter” use

When prompted to update their passwords after they've become stale (whether that's after 30, 60, 90 days — whatever is implemented by policy), many users simply increment the number that they may have ...
1
vote
1answer
164 views

how to use hash passwords to retrieve keys from keystore or access database

How do I hash the password for a keystore? How do I then use the hash to retrieve something from keystore? Similarly, how do I use a hashed password for accessing the database? I have encrypted the ...
1
vote
2answers
78 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
0
votes
1answer
92 views

What are the implications of an overly-restrictive password policy? [duplicate]

I came across an interesting password policy online recently: "Please be sure to enter a password that meets the following criteria: must be 8 characters long must not be based on dictionary words ...
0
votes
1answer
60 views

Is there an anti virus that protects processes from being injected code to?

As title says, is there an av that does that? And if not, is there any other program that protects processes like lsass in windows, apart from protected process utility in win8.1?
1
vote
1answer
118 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
1
vote
3answers
310 views

What are the possible rules to identify password sharing- to prevent fraud

I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
1
vote
2answers
169 views

What's wrong with a website including a password in a confirmation email? [duplicate]

I recently registered for a website and received an email that said "Thanks for registering, here's the username and password you used to sign up". The webmaster assures me that plaintext passwords ...
5
votes
3answers
525 views

Does it make any sense to alter a hashed password? [duplicate]

I've always wondered if it would make any sense to put fake characters into a hashed password? For example this is my password: 1234 and after hashing the password , this is the result: abcd Then ...
0
votes
2answers
98 views

Password history with PBKDF2

Scenario: Cannot use previous 15 passwords Using PBKDF2 with iterations targeting 1 second execution time In this scenario, when a user wishes to create a new password, the server must combine ...
-1
votes
1answer
218 views

Why don't we do dual password instead of forgot password?

You can see a link Forgot Password? nearby almost all login form. As I mentioned in question, Since passwords are completely protected from outside access unless owner reveal, I come up with this ...
1
vote
1answer
114 views

Is it a good idea to give users an additional password that they do not control?

It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When ...
0
votes
3answers
115 views

Using a Hash as a Salt? [duplicate]

Ive done a bit of reading on the subject of Hashes and Salts and I came up with an idea for a salting scheme but I wanted to check it with some people more learned than myself. My basic idea is to ...
7
votes
3answers
699 views

Do you think it's a good policy to disclose your password encryption method to users? [closed]

Do you think it’s a good idea to disclose your password encryption policies in your privacy policy or terms of service agreement? In other words, would you tell your users - and the world - you don’t ...
1
vote
3answers
94 views

Does my account lockout policy makes sense?

I have a web-based application where users can log on with username and password. I just implemented a new account lockout feature and was wondering whether it makes sense or I totally screwed it ...
1
vote
2answers
109 views

Is it bad to use the same sequence of characters in each password?

A friend of mine purposed a method of making passwords where each has the same base and added to it is something indirectly related to the site or product being signed into. For example all passwords ...
4
votes
3answers
172 views

Why is password strength often underestimated and uncertain in the context of password hashing?

An aspect of security has bugged me for a long time: Why is there positive certainty about the importance of hashing algorithms and salts, but password strength is either never mentioned at all or ...
1
vote
2answers
56 views

Problems with undefined password requirements [duplicate]

An annoyance of mine is when websites try to force me to use characters or a password policy that makes it difficult for me to remember (e.g. a number, lower-case, upper-case, special char, 5 - 10 ...
0
votes
0answers
25 views

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
1
vote
2answers
213 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least ...
3
votes
4answers
487 views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
3
votes
2answers
656 views

What are the pros and cons of using a password safe instead of writing passwords on paper?

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are ...
3
votes
2answers
346 views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
0
votes
2answers
116 views

Using the same base string for a password in several different logins [duplicate]

It is clear to me that using the same password for different websites is a bad idea because if an attacker manages to get a hold of your password, then he can gain access to the other websites in ...
2
votes
3answers
246 views

Where did common “minimum password length” guidelines originate?

Not long ago, the common wisdom was that passwords should be at least 8 characters long. These days, the most common minimum is 12. Where did these common values originate? Interestingly, 8 is ...
1
vote
3answers
225 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
2
votes
4answers
485 views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
4
votes
2answers
134 views

Guidance for “image based” password reset challenge

Thycotic has a Password Reset Server that allows the user to select from several images. What general guidance is there for an image-based password reset challenge question? Examples may include ...