3
votes
3answers
159 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
22
votes
5answers
2k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...