A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
211
votes
13answers
36k views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
47
votes
8answers
3k views
Why not allow spaces in a password?
"Your password can't contain spaces."
is a message I see from some websites,
including 1 .
Why?
(This question is very similar to Why Not Allow Special Characters In a Password? , but the answers ...
30
votes
8answers
1k views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
26
votes
7answers
944 views
Who is responsible for the strength of user's passwords?
Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user?
As a web developer, I've frequently wondered whether I should enforce the minimal password ...
25
votes
9answers
3k views
How long should the password be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
24
votes
10answers
2k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
22
votes
12answers
1k views
How secure are passwords made of whole english sentences
I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
21
votes
6answers
5k views
Sharing wifi at a business - Bad Policy?
Is it safe for a small business to let customers use their wifi while waiting?
My friend is starting up a small dentistry practice (1 dentist), and I'm setting up his computers/wifi as a favor. ...
21
votes
5answers
1k views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
17
votes
8answers
3k views
Why Not Allow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank. I know one that does not allow special characters (of any sort) in their passwords. Is their any valid reason for doing this? ...
17
votes
6answers
786 views
Why do some sites prevent users from reusing their old passwords?
I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used.
After all, I believe most of the ...
17
votes
9answers
2k views
Best password strength checker
In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
15
votes
3answers
2k views
Should I have a maximum password length?
I'm creating a webapp, and part of my authentication method is password length.
Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6).
Are there ...
15
votes
4answers
536 views
My credit union is reducing its maximum password length to 10 characters
I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
10
votes
5answers
294 views
What is the best way to hand out passwords to a widely spread diverse employee base?
I have a problem I need to solve - specifically, how to hand out passwords to people in a variety of locations, and with a wide variety of access.
I've thought of some options, but there are ...
9
votes
3answers
971 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
8
votes
4answers
935 views
Passwords - any statistics on user behavior?
I'm looking for analyses of how users choose and use passwords. I'm sure there are many resources out there that analyze user passwords. For instance, I've seen many people analyze dumps of password ...
8
votes
3answers
438 views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
8
votes
1answer
729 views
Password auditing
Most password policies require the password to be at least 8 characters long and contain symbols from at least 3 classes (lower case letters, upper case letters, numbers, other).
Problem is, that a ...
7
votes
4answers
1k views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
7
votes
2answers
223 views
Is it a security risk to remind users of the password requirements at login?
I regularly find myself trying to login to websites where I don't remember the password I use. I make some guesses as to what I might have used but usually wind up having to reset it.
One thing that ...
7
votes
5answers
368 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
7
votes
3answers
259 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
6
votes
7answers
627 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
6
votes
3answers
160 views
Is there any conceivable reason to prevent a password change in an authentication system?
I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
6
votes
3answers
275 views
An alternative to traditional passwords: is there some merit to this idea?
If you've got a website aimed at people that are not neccessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
6
votes
2answers
163 views
Does prompting for security questions on new computers add any security on banking websites?
When you sign into Bank of America on a computer you haven't used with them before, the site prompts you to answer one of your security questions.
How exactly does this make the site more secure?
...
5
votes
4answers
383 views
Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?
I thought the strength of a password depended on the total number of possible combinations. Therefore, allowing longer passwords should be safer because you then have more possibilities. But why do ...
5
votes
6answers
598 views
Does having a minimum number of digits improve password security?
Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
5
votes
2answers
333 views
Requiring regular password change but storing previous paswords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
5
votes
3answers
2k views
Regulations that specify password length?
I have read:
PCI DSS 1.2
SOX 404
AR 25-2
ISO 27001
But only PCI DSS specifies a minimum password length.
Are there any other regulations that dictate password lengths for any industry?
NIST ...
5
votes
2answers
240 views
Banning specific passwords?
There have been a couple of questions about enforcing good passwords, so I thought I'd add my own:
In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
5
votes
3answers
225 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
5
votes
2answers
280 views
How to refute “don't use internet if you don't like it” answer?
I hope it is legit question, similar to, for example, Why do law-abiding citizens need strong security?, et al. and it is tightly conected with user's security, privacy, etc.
The response I always ...
4
votes
9answers
436 views
How to easily remember lots of different passwords?
I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard.
What system do you recommend that ...
4
votes
4answers
292 views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
4
votes
4answers
223 views
Is Username/Display Name Login more secure than email login?
I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
4
votes
2answers
111 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
4
votes
2answers
171 views
How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”
First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
4
votes
3answers
270 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
4
votes
1answer
199 views
Computer team's password change time different from other users?
We need to determine a password policy for our organization.
All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
4
votes
1answer
268 views
How does the mobile security technology APNS and 3LM work?
APNS is an iPhone technology that assists with mobile push. 3LM is a BIOS-level security technology embedded in certain Android phones.
I recently got off the phone with Boxtone and they said they ...
3
votes
4answers
403 views
Is there any explanation (other than storing plaintext) for case-insensitive passwords?
I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view.
Is there any explanation for why ...
3
votes
4answers
147 views
Generate DB Password from license key - a good idea?
There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
3
votes
7answers
230 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
3
votes
4answers
478 views
Send new password by email is bad practice but what to do if user forgot his password?
According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ?
Just ask him to set a new one ?
3
votes
5answers
234 views
Password reset links: random value or authenticated message?
Which is better?
Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token.
Generate a random token and store it in the ...
3
votes
2answers
115 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
