A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

2
votes
2answers
135 views

What are the vulnerabilities of reusing passwords for generation of keys and encrypted files?

The main reason why reusing a password for different accounts is not recommended is that if the password is compromised, all accounts are compromised. This question is about vulnerabilities other ...
3
votes
0answers
245 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
12
votes
3answers
2k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
23
votes
10answers
5k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
11
votes
5answers
480 views

What is the best way to hand out passwords to a widely spread diverse employee base?

I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access. I've thought of some options, but there are ...
-4
votes
1answer
1k views

Good Password Length [duplicate]

If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
1
vote
5answers
285 views

Should I enforce a password policy on a web site?

For a commercial web site, is it important to impose some restriction on passwords to access the system? Eg. special $char, Upper and lower case, numbers, at least a minimum length... Can a CAPTCHA ...
5
votes
2answers
762 views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
1
vote
1answer
352 views

Why are Lengthy Password Stronger Than Complex? [duplicate]

So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
0
votes
1answer
187 views

What rules should be enforced for users to create a strong password?

I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
1
vote
3answers
3k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
3
votes
2answers
153 views

What exactly is the impact on security when forcing user passwords to contain a particular character?

Some years ago a sysadmin of large computing centre (on a campus) enforced the password of every single user to contain the character $ at an arbitrary position. They soon dropped this policy but I ...
4
votes
3answers
936 views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
3
votes
5answers
3k views

Password reset links: random value or authenticated message?

Which is better? Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token. Generate a random token and store it in the ...
2
votes
3answers
373 views

Account lockout with human interaction required to unlock

I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
12
votes
3answers
437 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
3
votes
4answers
172 views

Generate DB Password from license key - a good idea?

There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
4
votes
4answers
590 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
8
votes
2answers
472 views

Banning specific passwords?

There have been a couple of questions about enforcing good passwords, so I thought I'd add my own: In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
0
votes
2answers
550 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
5
votes
3answers
435 views

Use of rainbow tables with the NY Times hack?

The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military. One part of the story that ...
3
votes
7answers
2k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
0
votes
2answers
1k views

Can my ISP know my passwords

If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
0
votes
6answers
508 views

Using passwords made of words

People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
0
votes
3answers
2k views

Is it possible to change the wifi password with a script?

I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
2
votes
3answers
249 views

At what point is password complexity “safe enough”

Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill. Assuming that the average ...
3
votes
2answers
236 views

Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]

Possible Duplicate: Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations? Doesn't any constraints added to a password policy ...
7
votes
5answers
525 views

Are we concentrating too much on password complexity?

As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
1answer
248 views

Is a One Time Password Scheme based on Diceware viable and secure?

I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
23
votes
5answers
2k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
3
votes
2answers
229 views

Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?

I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords? I personally have a list of a ...
22
votes
7answers
5k views

Why don't people hash and salt usernames before storing them

Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext. What I ...
3
votes
1answer
521 views

Updated list of bad/overused passwords [closed]

I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these Is there a place that constantly analyzes hacked websites ...
15
votes
4answers
1k views

My credit union is reducing its maximum password length to 10 characters

I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
1
vote
2answers
513 views

Is dual control password is a feasible way to secure against unauthorized login?

I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
26
votes
12answers
4k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
20
votes
6answers
2k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
3
votes
5answers
268 views

Is there any good (or less bad) way to handle a web portal or website with awful security?

Background: I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As ...
5
votes
2answers
533 views

Requiring regular password change but storing previous paswords?

My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
4
votes
2answers
272 views

How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”

First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
2
votes
3answers
134 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
0answers
75 views

How can a service shorten a password if it is not stored in plaintext? [duplicate]

Possible Duplicate: How can Microsoft validate a shorter password on Microsoft accounts (MSDN)? My Microsoft password was 18 characters long and when I updated to Outlook.com it started to ...
3
votes
1answer
679 views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
5
votes
6answers
2k views

Does having a minimum number of digits improve password security?

Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
3
votes
3answers
167 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
3
votes
4answers
501 views

Is there any explanation (other than storing plaintext) for case-insensitive passwords?

I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view. Is there any explanation for why ...
3
votes
3answers
237 views

When changing a password, does it have to be completely different?

When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
1
vote
2answers
133 views

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good ...
6
votes
3answers
804 views

password complexity policy for non “English” passwords

In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
-2
votes
3answers
227 views

Password security : complexity and length [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? I've read that there is many solutions available to crack passwords. Reading these tips, I can ...