A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

3
votes
2answers
232 views

Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?

I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords? I personally have a list of a ...
3
votes
2answers
223 views

Home “datacenter” security, where and what to look for?

This is a question to learn more about security management and physical security. I'm running a small serverroom in the basement at home, mainly as testbed for attacks I dont want to try on live ...
3
votes
1answer
584 views

Updated list of bad/overused passwords [closed]

I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these Is there a place that constantly analyzes hacked websites ...
3
votes
3answers
240 views

When changing a password, does it have to be completely different?

When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
3
votes
3answers
315 views

Same User, Different Access Points, different passwords?

We have a system (e.g. purchasing) where there are multiple access points. One is a back-end desktop application only accessible by employees within the LAN, the other is an Internet accessible Web ...
3
votes
3answers
64 views

Account-lock security policy (username/password)

I am currently working on an application with regard to applying a security policy to the application. We are locking the account after X failed login attempts in Y minute. The account will be locked ...
3
votes
1answer
752 views

Why do some large companies still store passwords in plain text/decrypt-able format? [closed]

In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security: Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
3
votes
3answers
171 views

In what situations are web services required to protect confidentiality of user information?

I know that if a web application needs to be PCI-DSS or HIPAA compliant the user personal identifiable information (e.g. user password, etc) needs to be kept confidential. Under what other situations ...
3
votes
1answer
472 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
3
votes
1answer
263 views

Is a One Time Password Scheme based on Diceware viable and secure?

I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
3
votes
0answers
245 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
2
votes
6answers
1k views

Does Username + Password + Pin improve login security?

I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current ...
2
votes
3answers
254 views

At what point is password complexity “safe enough”

Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill. Assuming that the average ...
2
votes
3answers
136 views

How to make an outbound request to users to update their passwords?

Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
5answers
305 views

Is accepting old passwords a bad policy?

This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a ...
2
votes
3answers
393 views

Account lockout with human interaction required to unlock

I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
2
votes
2answers
265 views

Too many passwords?

Is it necessary to have hard drive and bios passwords if you also have full disk encryption, or maybe at least the hard drive password is unnecessary because there would be two passwords protecting ...
2
votes
2answers
141 views

Storing lots of passwords that different levels of employees need access to

I am wondering what other people do for storing passwords. Our current model at my employer is fundamentally flawed in my opinion, so I am trying to see what other people do so I can select the best ...
2
votes
1answer
210 views

Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate ...
2
votes
1answer
111 views

How could someone change a root password without modifying `chage -l root` date?

How could someone change the root password without changing chage -l root Last password change date? I know it was changed because it does not match the value in Keepass. I noticed when I tried to use ...
2
votes
2answers
153 views

Password reset system code system vs long hash

I'm building a password reset system at the moment and I've come across a dilema. Currently we have a system which creates a long md5 has (16 characters) and emails a link to a customer which they ...
2
votes
4answers
283 views

Why do some passwords not allow certain types of characters?

Is there any programing related reason why some password cannot have certain characters? If the idea in storing a password is to store it's hash, since a hashing function can take any input (ok at ...
2
votes
1answer
52 views

Is it sensible to use application password bypassing two factor authentication? [duplicate]

I discovered that some applications (like Sylpheed) seems unable to support two factor authentication. Google has a feature called application passwords - a separate password that "grants complete ...
2
votes
1answer
4k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
2
votes
3answers
357 views

Alternatives to Common Password Retrieval

Wired wrote an article recently about the top tech fails of 2012 and to no surprise, the password was on the list, more specifically the way a user can retrieve their passwords. What are some nifty ...
2
votes
3answers
120 views

Does my account lockout policy makes sense?

I have a web-based application where users can log on with username and password. I just implemented a new account lockout feature and was wondering whether it makes sense or I totally screwed it ...
2
votes
2answers
140 views

What are the vulnerabilities of reusing passwords for generation of keys and encrypted files?

The main reason why reusing a password for different accounts is not recommended is that if the password is compromised, all accounts are compromised. This question is about vulnerabilities other ...
2
votes
2answers
88 views

Randomness of hash token in password reset link [duplicate]

I want to know what are the points to be kept in mind while creating a hash token for my password reset links. In particular, how to make it un-predictable for an attacker?
2
votes
0answers
20 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...
2
votes
0answers
75 views

How can a service shorten a password if it is not stored in plaintext? [duplicate]

Possible Duplicate: How can Microsoft validate a shorter password on Microsoft accounts (MSDN)? My Microsoft password was 18 characters long and when I updated to Outlook.com it started to ...
2
votes
0answers
164 views

Lastpass - Can I just keep the previous autofills? [closed]

I just installed the Lastpass Firefox plugin, and it seems like a useful tool thus far. The only thing that drives me crazy is that I am used to the Firefox saved passwords where it will show the last ...
1
vote
3answers
4k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
1
vote
5answers
327 views

Should I enforce a password policy on a web site?

For a commercial web site, is it important to impose some restriction on passwords to access the system? Eg. special $char, Upper and lower case, numbers, at least a minimum length... Can a CAPTCHA ...
1
vote
6answers
3k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
1
vote
3answers
114 views

Is it possible to have a high confidence that a password is not being reused?

Have a few thoughts on the topic, but the general gist is if a user inputs a new password, is it possible to have a high confidence that a password is not being reused elsewhere? By elsewhere, I mean ...
1
vote
6answers
243 views

Does including the username in a password make it less secure?

Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and ...
1
vote
3answers
391 views

Is Password Complexity required at all

For a web-site I'm using what I hope is the most secure password storage scheme I can find, which boils down to having a salt and hashed password stored in a database of contacts:- Byte[] ...
1
vote
3answers
623 views

Password Security and ocl-Hashcat-plus

I recently read the Ars Technical Article about new features in ocl-Hashcat-plus. In light of questions like: Long Passwords: How are they more secure? and XKCD #936: Short complex password, or ...
1
vote
2answers
414 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least ...
1
vote
3answers
231 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
1
vote
4answers
192 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
1
vote
2answers
557 views

Is dual control password is a feasible way to secure against unauthorized login?

I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
1
vote
3answers
75 views

Password reset question answer complexity

I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell ...
1
vote
2answers
83 views

What is the evaluation criteria that a site uses for a password as strong , moderate or less secure

I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the ...
1
vote
2answers
360 views

MySql root password stored in .my.cnf

Before launch of a project, I reset the server's mysql root password. The colo that is hosting project wants the server's root database password stored in the .my.cnf file, in plain text, with the ...
1
vote
2answers
66 views

Problems with undefined password requirements [duplicate]

An annoyance of mine is when websites try to force me to use characters or a password policy that makes it difficult for me to remember (e.g. a number, lower-case, upper-case, special char, 5 - 10 ...
1
vote
1answer
38 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
1
vote
2answers
95 views

Can I force unique passwords for domain admin accounts?

Best practices would dictate that domain admins should not be logged into as such for daily tasks. Ideally the user would have two accounts; Their "daily" account and their domain admin account. How ...
1
vote
3answers
437 views

What are the possible rules to identify password sharing- to prevent fraud

I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
1
vote
2answers
227 views

What's wrong with a website including a password in a confirmation email? [duplicate]

I recently registered for a website and received an email that said "Thanks for registering, here's the username and password you used to sign up". The webmaster assures me that plaintext passwords ...