Tagged Questions
24
votes
10answers
3k views
Intel How Strong is Your Password page, good advice?
I came across this Intel How Strong is Your Password? page which estimates how strong your password is.
It has some advice on choosing better passwords including that you should use multiple ...
-3
votes
1answer
55 views
Good Password Length [duplicate]
If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
2
votes
1answer
108 views
Why are Lengthy Password Stronger Than Complex? [duplicate]
So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
4
votes
2answers
112 views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
211
votes
13answers
36k views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...
3
votes
2answers
126 views
What exactly is the impact on security when forcing user passwords to contain a particular character?
Some years ago a sysadmin of large computing centre (on a campus) enforced the password of every single user to contain the character $ at an arbitrary position. They soon dropped this policy but I ...
8
votes
3answers
262 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
3
votes
5answers
244 views
Password reset links: random value or authenticated message?
Which is better?
Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token.
Generate a random token and store it in the ...
4
votes
4answers
299 views
Insecure to require numbers in passwords?
Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
6
votes
2answers
246 views
Banning specific passwords?
There have been a couple of questions about enforcing good passwords, so I thought I'd add my own:
In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
5
votes
3answers
228 views
Use of rainbow tables with the NY Times hack?
The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that ...
0
votes
2answers
297 views
Can my ISP know my passwords
If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
1
vote
3answers
163 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
2
votes
7answers
396 views
Is it possible to detect password length from hash? Does doubling your password add more security?
Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
0
votes
3answers
230 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
3
votes
7answers
232 views
Generate user a password instead of asking for one?
I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that have do use this approach?
...
3
votes
2answers
116 views
Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]
Possible Duplicate:
Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations?
Doesn't any constraints added to a password policy ...
7
votes
5answers
377 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
1answer
133 views
Is a One Time Password Scheme based on Diceware viable and secure?
I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
1
vote
3answers
164 views
At what point is password complexity “safe enough”
Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill.
Assuming that the average ...
3
votes
2answers
189 views
Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords?
I personally have a list of a ...
17
votes
7answers
2k views
Why don't people hash and salt usernames before storing them
Everyone knows that if they have a system that requires a password to log in, they should be storing a hashed & salted copy of the required password, rather than the password in plaintext.
What I ...
6
votes
7answers
627 views
How can I prevent users from entering bad passwords in my web application?
There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
2
votes
1answer
135 views
Updated list of bad/overused passwords [closed]
I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these
Is there a place that constantly analyzes hacked websites ...
1
vote
2answers
180 views
Is dual control password is a feasible way to secure against unauthorized login?
I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
15
votes
4answers
537 views
My credit union is reducing its maximum password length to 10 characters
I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
22
votes
12answers
1k views
How secure are passwords made of whole english sentences
I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
4
votes
9answers
443 views
How to easily remember lots of different passwords?
I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard.
What system do you recommend that ...
17
votes
6answers
792 views
Why do some sites prevent users from reusing their old passwords?
I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used.
After all, I believe most of the ...
5
votes
2answers
337 views
Requiring regular password change but storing previous paswords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
4
votes
2answers
172 views
How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”
First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...
2
votes
3answers
102 views
How to make an outbound request to users to update their passwords?
Clearly it works best if the request to update a password happens as a response to an inbound request to access a known system, but how do you make an outbound request to users to update their ...
2
votes
0answers
68 views
How can a service shorten a password if it is not stored in plaintext? [duplicate]
Possible Duplicate:
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
My Microsoft password was 18 characters long and when I updated to Outlook.com it started to ...
3
votes
1answer
279 views
Why do some large companies still store passwords in plain text/decrypt-able format? [closed]
In the last couple of weeks I've come across two fairly large companies who seem to not have stringent password security:
Tesco - they store passwords in an "encrypted" format, yet they can decrypt ...
5
votes
6answers
605 views
Does having a minimum number of digits improve password security?
Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
9
votes
3answers
982 views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
3
votes
4answers
405 views
Is there any explanation (other than storing plaintext) for case-insensitive passwords?
I've come across a few organisations stating that passwords are case-insensitive. Obviously this is ridiculous, and a gigantic red flag from a security point of view.
Is there any explanation for why ...
1
vote
2answers
83 views
is it appropriate to set restrictions on a user's password? [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
Im developing a website and am curious as to the current trends in the nature of passwords. Is it good ...
3
votes
3answers
184 views
When changing a password, does it have to be completely different?
When changing a password how important is it to have a significantly different one? For example is it bad to reverse the sequencing of the old password to make a new one or change a few numbers?
-2
votes
3answers
132 views
Password security : complexity and length [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
I've read that there is many solutions available to crack passwords.
Reading these tips, I can ...
4
votes
3answers
272 views
password complexity policy for non “English” passwords
In an internationalized application, what is the best practice for a policy on complexity of passwords? I am not having luck searching for the answer. Wikipedia lists these items for password ...
1
vote
2answers
316 views
Long Passwords: How are they more secure? [duplicate]
Possible Duplicate:
XKCD #936: Short complex password, or long dictionary passphrase?
How are long passwords more secure? The only situation in which I can accept long passwords are more ...
20
votes
5answers
1k views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
-1
votes
6answers
279 views
Using passwords made of words
People say don't use passwords in the dictionary but if you use two words isn't it alright? Dictionaries have at least 10,000 entries so just two words will be 100,000,000 possibilities (and that's ...
30
votes
8answers
1k views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
3
votes
4answers
493 views
Send new password by email is bad practice but what to do if user forgot his password?
According to http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in it's bad so what to do ?
Just ask him to set a new one ?
0
votes
1answer
183 views
What's the idea behind requiring users to change password periodically? [duplicate]
Possible Duplicate:
How does changing your password every 90 days increase security?
Some sites require users to change their password every x days. For example, at least 3 online banking ...
6
votes
3answers
275 views
An alternative to traditional passwords: is there some merit to this idea?
If you've got a website aimed at people that are not neccessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
2
votes
0answers
96 views
Lastpass - Can I just keep the previous autofills? [closed]
I just installed the Lastpass Firefox plugin, and it seems like a useful tool thus far. The only thing that drives me crazy is that I am used to the Firefox saved passwords where it will show the last ...
8
votes
3answers
439 views
How can I promote good password practices in an organization that doesn't currently care about that?
I work with an organization that uses some very poor practices such as using default user accounts, default passwords (or passwords the same as user accounts), sharing password information between ...
