A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
6
votes
2answers
163 views
Does prompting for security questions on new computers add any security on banking websites?
When you sign into Bank of America on a computer you haven't used with them before, the site prompts you to answer one of your security questions.
How exactly does this make the site more secure?
...
24
votes
10answers
2k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
10
votes
5answers
296 views
What is the best way to hand out passwords to a widely spread diverse employee base?
I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are ...
-3
votes
1answer
52 views
Good Password Length [duplicate]
If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
0
votes
5answers
98 views
Should I enforce a password policy on a web site?
For a commercial web site, is it important to impose some restriction on passwords to access the system?
Eg. special $char, Upper and lower case, numbers, at least a minimum length...
Can a CAPTCHA ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
4
votes
2answers
111 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
2
votes
1answer
107 views
Why are Lengthy Password Stronger Than Complex? [duplicate]
So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
0
votes
1answer
63 views
What rules should be enforced for users to create a strong password?
I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
0
votes
3answers
247 views
What do I need to do to secure log-in and registration for my website?
What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
211
votes
13answers
36k views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
47
votes
8answers
3k views
Why not allow spaces in a password?
"Your password can't contain spaces."
is a message I see from some websites,
including 1 .
Why?
(This question is very similar to Why Not Allow Special Characters In a Password? , but the answers ...
3
votes
2answers
123 views
What exactly is the impact on security when forcing user passwords to contain a particular character?
Some years ago a sysadmin of large computing centre (on a campus) enforced the password of every single user to contain the character $ at an arbitrary position. They soon dropped this policy but I ...
4
votes
4answers
227 views
Is Username/Display Name Login more secure than email login?
I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
3
votes
5answers
237 views
Password reset links: random value or authenticated message?
Which is better?
Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token.
Generate a random token and store it in the ...
2
votes
3answers
185 views
Account lockout with human interaction required to unlock
I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
7
votes
3answers
260 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
9
votes
3answers
979 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
3
votes
4answers
148 views
Generate DB Password from license key - a good idea?
There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
4
votes
4answers
294 views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
5
votes
2answers
241 views
Banning specific passwords?
There have been a couple of questions about enforcing good passwords, so I thought I'd add my own:
In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
0
votes
2answers
166 views
What are RealVNC 5.0 Authentication Protocol Security Limitations?
In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
17
votes
9answers
2k views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
25
votes
9answers
3k views
How long should the password be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
5
votes
3answers
227 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
2
votes
7answers
395 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
0
votes
2answers
291 views
Can my ISP know my passwords
If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
-1
votes
6answers
279 views
Using passwords made of words
People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
0
votes
3answers
220 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
1
vote
3answers
164 views
At what point is password complexity “safe enough”
Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill.
Assuming that the average ...
3
votes
7answers
232 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
3
votes
2answers
116 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
7
votes
5answers
370 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
1answer
133 views
Is a One Time Password Scheme based on Diceware viable and secure?
I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
3
votes
2answers
189 views
Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords?
I personally have a list of a ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
6
votes
7answers
627 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
2
votes
1answer
134 views
Updated list of bad/overused passwords [closed]
I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these
Is there a place that constantly analyzes hacked websites ...
15
votes
4answers
537 views
My credit union is reducing its maximum password length to 10 characters
I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
1
vote
2answers
173 views
Is dual control password is a feasible way to secure against unauthorized login?
I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
26
votes
7answers
945 views
Who is responsible for the strength of user's passwords?
Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user?
As a web developer, I've frequently wondered whether I should enforce the minimal password ...
22
votes
12answers
1k views
How secure are passwords made of whole english sentences
I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
4
votes
9answers
438 views
How to easily remember lots of different passwords?
I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard.
What system do you recommend that ...
2
votes
6answers
340 views
Does Username + Password + Pin improve login security?
I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current ...
17
votes
6answers
790 views
Why do some sites prevent users from reusing their old passwords?
I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used.
After all, I believe most of the ...
2
votes
5answers
174 views
Is there any good (or less bad) way to handle a web portal or website with awful security?
Background:
I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As ...
5
votes
2answers
336 views
Requiring regular password change but storing previous paswords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
4
votes
2answers
171 views
How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”
First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
