Hot answers tagged

1027

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked. Soon, the chimps learn that the bananas and the stepladder ...


231

It's a leftover from the time when keypads didn't have the letters Q and Z. Security-wise, there's no reason. It's just because of old systems. To clarify: You used to be able to enter your password over the phone. Some phones didn't have the letters Q or Z, like the one on the picture below. Image courtesy: Bill Bradford on flickr.com Because of ...


146

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method. This is a good question, and I'm going to depart from the norm here, ...


136

These restrictions are often put in place for various reasons: Interaction with legacy systems that do not support long passwords. Convention (i.e. "we've always done it that way") Simple naivety or ignorance. As far as security goes, there is no need to limit password lengths. They should be hashed anyway, using a KDF such as bcrypt. To help with ...


127

There's several possibilities. They could be storing the full password in plaintext, and only displaying the last 4 characters to the support person. They could be hashing the password twice. Once hashing the full password, and again with just the last 4. Then the support person types in the last 4 to see if it matches the hashed value. The problem with ...


120

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these passwords unless the attacks change. The attack lists generally derive from studying breaches. Attackers are smart enough to look at lists to figure out high ...


116

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other websites that this user has accounts on. This is a great question! Good find! But you seem to be overlooking two points: This is no weaker than not having MFA,...


111

A lone password is not necessarily verifiable by itself. In particular, if the server does things properly, then it stores not the passwords themselves, but the output of a password hashing function computed over the password. A password hashing function (as opposed to a mere hash function) includes some extra features, including a salt (for very good ...


102

The only sensible way to get what you want is to ask for the password when a user changes their username. This way the server always has the information needed to conduct an accurate comparison between the username and password during a change, and prevent matches. As sensitive operations - such as changing passwords, or in your case usernames - should ...


95

If you do not divulge your "password requirements" then your users will hate you. Some will not succeed in finding an "acceptable password" and will call the helpdesk. Or, worse, if the users are customers then they will go buy elsewhere. A great way to kill your own business ! On the other hand, if divulging your "password requirements" really help ...


84

Salted hashes are designed to protect against attackers being able to attack multiple hashes simultaneously or build rainbow tables of pre-calculated hash values. That is all. They do nothing to improve the underlying strength of the password itself, weak or strong. This also means that they're not designed to defend against online attacks, so they ...


83

It's horrible :) To provide some numbers to back claims by other answers: This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits per year! Average word count for a song is 300-600, depending on the style, and they do 7-10 words per sentence (And I imagine that's the comfortable length of a ...


77

For one thing the server would not know if the password alone matched any accounts. In a secure system, passwords are salted and then hashed. In a simplistic demo, suppose I had three users: Username Password bob foobar alice foobar maggie foobar When these passwords are set, a salt is added and a hash is generated: Username Salt ...


71

I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought. Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of ...


68

If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected access indefinitely. Now, if your password is secret-may16 and the attacker is locked out when you change your password, he is certainly going to try secret-...


66

A harder to guess username adds to the security if it's kept secret. The problems are Usernames are often not kept especially secret. On most systems allowing multiple users to log in, any user can view the list of valid users. On systems that run mailservers, the mailserver can effectively be used to check if a username might be valid as most mailservers ...


64

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing short numerical passwords and puts forward the often used excuse that “We want to allow people to use the same password on the telephone keypad” The only ...


59

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, a 6-digit PIN is not as vulnerable as you might think. An attacker that tried three PINs every day for a whole year, would still only have about a 0.1% chance ...


58

Reason may be: This Windows has implemented a strong password policy, thus the user MUST HAVE a "strong" password.


54

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password scheme which allows all 95 printable ascii characters, then the key space ramps insanely quickly every time you increase the length of the password by 1. You ...


50

If they store it in plaintext or encrypted plaintext, then that's probably the maximum value that can be stored in the DB. On the other hand one should get as far as possible from these sites To avoid DOS attacks. This is usually if they have a very high limit, like 512 or 1024 bytes To comply with regulations that are actually made by people not knowing ...


49

One explanation I haven't seen here is that many financial institutions are tightly integrated with older systems and are bound to the limitations of those systems. The irony of this is that I have seen systems that were built to be compatible to older systems but now the older systems are gone and the policy still must exist for compatibility with the ...


44

As Mike and Gumbo have mentioned in comments, a salt isn't intended to add protection to bad passwords. It's meant to keep the attackers from breaking the whole database at once. The length of the salt isn't meant to add difficulty to breaking the stored passwords. It's meant to ensure that your salt is reasonably unique compared to others on the Internet, ...


38

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP ...


38

I asked this question at Bol.com, one of the biggest webshops in the Netherlands. Their response was to prevent being flooded with support emails about forgotten passwords. They then curiously ignored my inquiry about the password reset feature which just emails you a reset link when you have forgotten your password. I've concluded that it's most likely a ...


38

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


38

You have to consider two attack vectors: Online attack Offline attack Limiting login guessing helps against Online attacks. Let's say it's three times, this means that an attacker can test ALL accounts for the three most common passwords that fit your password policy (how about "password", "12345678" and "12345"?). Salting helps against Offline attacks ...


36

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...



Only top voted, non community-wiki answers of a minimum length are eligible