A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

1
vote
2answers
105 views

Website sent me my new password (after reset) in clear text [duplicate]

I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the ...
28
votes
6answers
5k views

What is the point of making a complicated PUBLIC password?

I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer. When running these images, a complete Windows environment is ...
3
votes
3answers
89 views

What is the argument for the fairly prevalent “No more than n repeating characters” password rule?

So, I understand why most commonly used password policies are used. N character minimum? No low hanging fruit left for brute force attacks. N character maximum? The database field can only be so ...
19
votes
4answers
4k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
1
vote
2answers
132 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
5
votes
1answer
61 views

Unique Touchscreen Authentication Schemes

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure. The initial thought process was to simply use a standard username ...
4
votes
1answer
106 views

Protecting SSH service with many inexperienced users

One of the universities I know has a rather unique password policy. They issue shell accounts to all computing students with strong passwords that are unchangeable. It is done via the passwd -n flag ...
370
votes
14answers
60k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
0
votes
1answer
26 views

When do system access policies start to become source of security incidents? [closed]

Consider the assumption we are dealing with systems handling secret information which is crucial for an organization's existence. I would like to know what is a good balance between security ...
24
votes
10answers
5k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
4
votes
7answers
4k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
4
votes
5answers
217 views

How many combinations does a specific password policy allow?

Recently I was arguing about password policies. Assume you have a policy which requires 10 characters and additionally at least one letter, one number and one special character. My companion was ...
1
vote
2answers
158 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
0
votes
2answers
31 views

Advantages of Enabling Firmware Password Protection

What security advantages, if any, would be gained by enabling Firmware Password Protection on a mac that allready has filevault encryption for the disk?
2
votes
1answer
55 views

How much should I change my 64 character TrueCrypt password?

I got a TrueCrypt container which is using a 64 character password. This password contains all the different kind of characters available to me (upper case, lower case, digits, special). It's taken ...
2
votes
3answers
231 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
12
votes
4answers
1k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
4
votes
1answer
69 views

Forgot Username/Email - Do extra credentials equal enough to log the user in?

I am working with another UX guy and he's let me know that there have been some studies surrounding the fact that when a person goes through a "forgot username/email" process, they enter in extra ...
41
votes
9answers
12k views

How long should the password be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
12
votes
7answers
2k views

Why don't we reward users who choose strong passwords? [closed]

Suppose there is a web property that has some sort of reward system or commodity that its users desire. It could be reputation on Stack Exchange-like sites, rank badges on message boards, or add-on ...
16
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
4
votes
2answers
304 views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
1
vote
2answers
114 views

Do I need to set maximum characters length for password using bcrypt?

I using bcrypt to create a password hash and in the php documentation it says Caution: Using the PASSWORD_BCRYPT for the algo parameter, will result in the password parameter being truncated to ...
1
vote
3answers
105 views

What are the pitfalls of repeating a password multiple times for increased length and entropy?

Many of us are familiar with this comic. If I had a word like "catfish" and just repeated it an arbitrary amount of times, say n, it would be theoretically stronger. Wouldn't it? One pitfall I ...
27
votes
4answers
3k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
2
votes
1answer
207 views

Trusted Platform Module (TPM) secure password

I'm trying to set secure Trusted Platform Module (TPM) passwords on a network and would like to set it to the maximum length possible. How long can the TPM's password be? Is it limited by bits or by ...
0
votes
2answers
95 views

Need some docs that say we shouldn't upper the string when saving it as a password [closed]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
46
votes
9answers
15k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
2
votes
0answers
48 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
1
vote
3answers
127 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
4
votes
3answers
1k views

Why do some websites force users to come up with difficult passwords?

I can't understand why we commonly force users to come up with difficult to remember passwords. * Your password must contain at least one number, one uppercase character, and one special ...
0
votes
1answer
54 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
1
vote
3answers
139 views

cleartext passphrase for keystore

How is passphrase for a keystore to be stored? we have all passwords encrypted and the key to encrypt is stored in keystore , so how is the passphrase for the keystore to be stored? in clear text? if ...
3
votes
3answers
103 views

Account-lock security policy (username/password)

I am currently working on an application with regard to applying a security policy to the application. We are locking the account after X failed login attempts in Y minute. The account will be locked ...
1
vote
1answer
59 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
2
votes
2answers
234 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
0
votes
1answer
68 views

What are the reasons behind Oracle password restrictions?

Oracle presents a fairly restrictive password policy: Passwords can be from 1 to 30 characters. The first character in an Oracle password must be a letter. Only letters, numbers, and the ...
2
votes
2answers
143 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
3
votes
2answers
141 views

Adding a new user: email temp password vs link with token

I'm a developer working on a website for the first time and have a question about new user activation. The way our site is setup now a user creates a new account and they get emailed a temporary ...
2
votes
1answer
65 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
4
votes
2answers
112 views

Should password recommendations be different for devices, networks, and internet?

I started using a password manager last year and updated nearly all of my internet accounts to super-strong, unique passwords, and that isn't a problem, cause I only access them from web browsers or ...
4
votes
4answers
256 views

how to check for duplicate passwords

Is it possible to check if like 100 people are using the same pasword? without risking anyones password getting out? I heard google does this, not allowing the user to set a password 1000 people are ...
-1
votes
1answer
31 views

Double step verification system for homepage

I want to share some of my work with some double step verification system. PGP is not enough, since some of my clients cannot use it. First, you need a password to login but you also need the code ...
11
votes
2answers
1k views

How can I find out the password hashing schemes used by the specific Unix accounts I log in to?

Every day I ssh in to 3 or 4 independent Unix accounts. I have been regarding them as more or less "equivalently secure" on the grounds that I'm using ssh, but after learning of how much variety ...
11
votes
4answers
966 views

Does it indicate a bad password system to disallow certain characters in passwords?

When creating an account to the game League of Legends, the user's password must comply to a few rules. The one I'm concerned about is the "Must not contain slashes or spaces" one. The others are ...
1
vote
2answers
102 views

What is the evaluation criteria that a site uses for a password as strong , moderate or less secure

I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the ...
7
votes
4answers
2k views

password complexity policy for non “English” passwords

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
20
votes
5answers
4k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
0
votes
1answer
215 views

Is there a FIPS 181 like standard for random password generation with alphanumerical seed?

NIST recommends FIPS 181 as a random password generator for "easy to remember" passwords. As far as I understand the standard: it will generate a password that is lowercase, and with some ...
1
vote
3answers
155 views

Password history with PBKDF2

Scenario: Cannot use previous 15 passwords Using PBKDF2 with iterations targeting 1 second execution time In this scenario, when a user wishes to create a new password, the server must combine ...