A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

25
votes
8answers
2k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
2
votes
7answers
332 views

Does including the username in a password make it less secure?

Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and ...
0
votes
1answer
51 views

What security policies and practices could one practice to safegaurd against being inebriated?

My passwords for the most part as well as access procedures I could do while inebriated/intoxicated. Be it a simple login/password login to email or VPN and accessing a database. This might sound ...
63
votes
4answers
8k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. ...
1
vote
3answers
77 views

Could these special characters be used in a password?

To use a good password, I was thinking about adding special characters. I remember that some login services don't allow all characters. Perhaps it depends also on the keyboard layout. Could these ...
32
votes
12answers
9k views

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
1
vote
1answer
40 views

Is there a functional difference between `chage -M 99999`and `chage -M -1`on Linux?

My group just requested a security scan on some of our development systems and were informed that a number of system type accounts were insecure because the password did not have a maximum time limit. ...
3
votes
5answers
526 views

How secure is changing or adding a single character in your passphrase?

I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their ...
15
votes
8answers
3k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
3
votes
1answer
687 views

Why are lengthy passwords stronger than complex ones? [duplicate]

So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to ...
10
votes
3answers
1k views

An authoritative source for why you should NEVER give your password to anyone?

I know this might be a bit subjective, but it's based on this popular question here. Hopefully this is acceptable. The problem with that question and answer is that I can't send it to my boss and ...
0
votes
0answers
22 views

Scheduled tasks that need domain admin privileges

I have a Windows 10 box that runs a whole bunch of Powershell scripts, some of those contain cmdlets that need to be run against a DC, or mail server, for eg. Get-ADComputer, and ...
0
votes
2answers
68 views

Pros and cons of password policy filtering common weak passwords? [duplicate]

We all know the basics "password rules" when a user register on a website, such as: more than 8 characters, must contain an upper case letter, must contain numbers and so on Why don't websites ...
0
votes
0answers
44 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
-4
votes
1answer
483 views

Why don't we do dual password instead of forgot password?

You can see the link "Forgot Password?" nearby almost all login form. Since passwords are completely protected from outside access, I come up with this question. I accept that the forgot password ...
0
votes
2answers
2k views

How hard is it to hack into a webmail account with a strong 8 character password?

Assume the hacker starts with only your email address and he has high incentive to gain access. UPDATE: Also assume the password is unique (never used elsewhere) and it is NOT a guessable word like ...
4
votes
3answers
613 views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries ...
2
votes
2answers
103 views

Are there any examples of huge damages done by password leaks, or bad password management policies? [closed]

Everybody knows that a strong password is very important. However, I can't find any citable public example of any kind where a user or users suffered a heavy loss from using bad passwords, or their ...
10
votes
5answers
12k views

Regulations that specify password length?

I have read: PCI DSS 1.2 SOX 404 AR 25-2 ISO 27001 But only PCI DSS specifies a minimum password length. Are there any other regulations that dictate password lengths for any industry? NIST ...
1
vote
3answers
105 views

Why shouldn't I use an old password? [duplicate]

Some services like Google or Facebook forbid me to use a password that has already been use for the same account in the past. My question is, if this old password was never compromised (i.e it was ...
24
votes
5answers
1k views

Would turning a Diceware phrase into a sentence decrease its security?

Diceware passphrase lengths are on the rise - up to six or seven words now. The old adage that passphrases are easier to remember may be true for shorter phrases, but six truly random words can be ...
1
vote
0answers
30 views

password aging, advantages and disadvantages [duplicate]

What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
11
votes
3answers
130 views

Reason to ban digits as first character in passwords?

When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far: At least 8 characters but no more than 13. Only usage of “valid” ...
8
votes
2answers
121 views

How can I enforce strong password policy with non-technical user base?

I've been using zxcvbn to enforce strong passwords for a service where break-ins would cause considerable problems. However, the service is only viable if many users sign up. We've found that users ...
9
votes
2answers
244 views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
3
votes
3answers
163 views

Prevent password reusing across different sites

I'm generally against too strict or complex rules to accept passwords (rules like "It must contain at least one upper-case character, one number and one symbol" and things like that, see also XKCD ...
4
votes
1answer
79 views

Is limiting/cutting password-length without notice insecure?

I have encountered that our linux system cuts the length of every password to a certain length, after that length every additional character seems to be ignored. Does this make our linux system more ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
3
votes
1answer
94 views

Unable to completely enforce password policy

PCI DSS has a few requirements regarding the password policy (like remember last four passwords, change password every 90 days, use at least seven numeric and alphabetic characters and more). These ...
3
votes
1answer
95 views

Is locally reusing a password a bad practice?

All my valuable data is in VeraCrypt volumes. The (very strong) keys of the volumes are stored in a single KeePass database, which uses a reasonably strong password. I want to encrypt my backups too, ...
9
votes
3answers
2k views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
8
votes
5answers
3k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
4
votes
1answer
1k views

Why does ebay prohibit certain characters in password strings?

I had to change my ebay.com password today and, to my surprise, I was not allowed to use certain characters. For example [ results in an 'invalid' password and the system refuses to accept it. Is ...
8
votes
3answers
1k views

How can I store a password history to prevent reuse?

I have an application with a user database. The database stores the password using a bcrypt hash with a randomized salt. How can I implement a password history set (to prevent password reuse) in a ...
40
votes
7answers
33k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
11
votes
5answers
2k views

Passwords - any statistics on user behavior?

I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
4
votes
4answers
389 views

If A Password Is Unique, Does It Really Matter How “Strong” It Is?

People seemed to find this "If a Password is Super-Strong Does it Matter if It's Unique" question very interesting, but it actually reminded me that the converse question is interesting, too: If you ...
-2
votes
3answers
332 views

Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's ...
5
votes
3answers
176 views

How can I write a good corporate password policy?

Our company works in health care, and we've written a corporate security policy, including passwords. Something that I noticed about the policy and have commented on, it says the password should not ...
1
vote
2answers
125 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized ...
139
votes
16answers
18k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
24
votes
10answers
7k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
19
votes
3answers
3k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
2
votes
0answers
126 views

Has password strength been an *actual* problem in a professional context? [closed]

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the ...
4
votes
4answers
540 views

What to do when asked for a weak password

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
0
votes
1answer
83 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
2
votes
2answers
237 views

Is this password inside a file secure? A security paradox

Preamble: I have been a long time lurker but first time poster to the Information Security site, so please be gentle with me. The Situation: I ran into a situation where I needed to securely store a ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
5
votes
1answer
117 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...