Tag Info

If you maintain a Web site in which users can sign up and protect their account with a password, then you should edict a policy of minimal password length -- and, please, nothing else. Stricter rules, more often than not, backfire. For proper security, you need to enlist user cooperation, which will exist only on a voluntary basis. The more you enforce, the ...

No. You should use federated logon and avoid the entire problem. Select an identity provider who matches or exceeds the risk level of the information you're protecting. Let them worry about passwords.

There may be modern forms of CAPTCHA that do not have automated tools yet, but a quick Google search will provide tools to crack various CAPTCHA systems with varying success rates. In addition, not only are there sites that pay people to interpret CAPTCHAs (including Amazon's Mechanical Turk), but some warez include a CAPTCHA that must be passed in order to ...

CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems. CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything. ...

Captchas can be cracked using automated tools. Complex passwords make it harder for attackers to brute-force password attempts and helps to reduce the number of 'common' passwords. Password policies should be in place for web sites, no question. Work with your users to determine a policy that makes sense. Sometimes a super-secure password policy can give ...

I would think that you should enforce some level of password requirements. If your password hashes get compromised and some unfortunate soul used password123 as his password, his account could be compromised very quickly even if the passwords are hashed and salted. A human attacker with the plaintext password and the username could easily just fill in the ...