Tag Info

Hot answers tagged

668

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked. Soon, the chimps learn that the bananas and the stepladder ...


206

It's a leftover from the time when keypads didn't have the letters Q and Z. Security-wise, there's no reason. It's just because of old systems. To clarify: You used to be able to enter your password over the phone. Some phones didn't have the letters Q or Z, like the one on the picture below. Image courtesy: Bill Bradford on flickr.com Because of ...


92

These restrictions are often put in place for various reasons: Interaction with legacy systems that do not support long passwords. Convention (i.e. "we've always done it that way") Simple naivety or ignorance. As far as security goes, there is no need to limit password lengths. They should be hashed anyway, using a KDF such as bcrypt. To help with ...


87

If you do not divulge your "password requirements" then your users will hate you. Some will not succeed in finding an "acceptable password" and will call the helpdesk. Or, worse, if the users are customers then they will go buy elsewhere. A great way to kill your own business ! On the other hand, if divulging your "password requirements" really help ...


65

I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought. Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of ...


46

You see that thing up there where it displays your username? They can't do that if the username is stored hashed now can they? One word, usability.


36

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


34

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


34

Sending you the password in plain text does not necessarily mean the database stores it in plain text, especially if they sent you the email before encrypting and storing the password. However if you ask for the password later on (e.g "forgot password" mechanism) and they do send it to you like this, it implies that they are either storing in plain text or ...


32

If they store it in plaintext or encrypted plaintext, then that's probably the maximum value that can be stored in the DB. On the other hand one should get as far as possible from these sites To avoid DOS attacks. This is usually if they have a very high limit, like 512 or 1024 bytes To comply with regulations that are actually made by people not knowing ...


32

The real reason why such policies are in place is because they are in place by default. That's how things go in Active Directory: Passwords expire after 42 days. When changing his password, the (non-admin) user cannot reuse one of his 24 previous passwords. User cannot change his password twice within the same 24-hour frame. So you will encounter such ...


28

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP ...


26

Because, as LinkedIn and other recent password leakages reveal, still the most common passwords for websites are "password", "god", "123456", etc. So you can brute-force with really short list of most common passwords. Still, you can just ban those passwords, or require long password - as possible combinations grow exponentially with the length, and ...


25

You should salt and hash the password instead of storing it in clear text. The hash function will result in a constant output size regardless of the length of the input string. Using a minimum length and perhaps some other quality rules is a good idea because it helps a little against laziness. If you are afraid of Denial of Service attacks, you could put ...


24

Leading and trailing spaces could be trouble for people who are loose with copy and paste. Otherwise, agreed with the other posts, no good reason. Although, what other characters are we blocking? tab, cr, lf, backspace, beep ☻☺♪▬♣. ?


23

I would cite an attempt to reduce customer service related issues. The larger and more complex a passwords is the higher the likelihood for the customer to enter invalid password, get locked out and then contact customer service tying up that individual's time. It is amazing how many people are unable to accurately type a normal weak password, let alone ...


23

You cannot answer this question without answering the following question If a user's password is compromised, does that only put that user/that user's data at risk, or does it also put other users at risk? If the system does not compartmentalize accounts, then a user cannot keep their data safe by choosing appropriate credentials, so administrators ...


23

If you don't tell the user exactly what's needed in his password to go through the validation of your function, how would he know what to add or modify to make it valid? Giving such information could result in making a bruteforce attack easier. However, considering your requirements, it doesn't help the attacker at all because there are too many password ...


23

Typically it is used in combination with a password history policy, eg “you can't re-use any of your last 12 passwords”. Without a minimum-change-period it would be possible to circumvent this by changing your password 12 times in a row, back to the original. It is IMO of pretty doubtful value.


22

While what Terry is saying is true, sometimes login systems actually hash the username (but without salt). They have you pick a log in name and a display name. The logging name is stored hashed (without salt because you need to be able to look it up) and the password gets salted. The display name is different from your login name (because this should be kept ...


22

There are a few reasons that limits might have been imposed: Some developers feel that reasonable limits (e.g. 120 chars) help reduce server load for hashing ludicrously sized passwords. In reality, the transfer overheads are probably more intensive, as the data is reduced down to a fixed length state in the first round of most hashes, so it's a rather ...


21

Yes you are right. Using a pool of passwords is definitely recommended but the passwords should not follow a pattern (at least not the one suggested by intel) but that is how we think (we are security guys). May be the writer was thinking from a common user's point of view because most common users simply don't want to take the headache of remembering ...


20

One explanation I haven't seen here is that many financial institutions are tightly integrated with older systems and are bound to the limitations of those systems. The irony of this is that I have seen systems that were built to be compatible to older systems but now the older systems are gone and the policy still must exist for compatibility with the ...


20

No (with a minor exception at the bottom). The passphrases "correct horse battery staple" and "correcthorsebatterystaple" are equivalent entropy-wise. Choosing to put spaces in an incorrect spot or sometimes including spaces and sometimes not including spaces will give you a few extra bits of entropy; but its not worth it for the extra difficulty ...


20

Would be great if the answer contains some calculations which estimate the password security and some references about this topic. I very recently answered almost the exact same question here: Confused about (password) entropy The time it takes to crack your password is exactly equal to the amount of time it takes to test a single password multiplied ...


18

Is it safe for a small business to let customers use their wifi while waiting? No. Even if no customer intentionally attacks his WiFi network they could be carrying some type of malware on their laptop/smart phone/portable device that might spread. Additionally the WiFi signal doesn't end at the front door. You have probably connected to a WiFi some ...


18

I asked this question at Bol.com, one of the biggest webshops in the Netherlands. Their response was to prevent being flooded with support emails about forgotten passwords. They then curiously ignored my inquiry about the password reset feature which just emails you a reset link when you have forgotten your password. I've concluded that it's most likely a ...


18

If the length of the hash varies depending on input, then it is not a hash. A cryptographic hash function, by definition, offers a fixed-size output, regardless of the input. For instance, SHA-256 offers a 256-bit output, always; never more and never less. Password hashing is a specific activity which is often discussed in this site. The short answer is: ...


17

You can test whether or not certain users do this without saving any additional data which might potentially weaken security. Just check what their previous password would have been when they follow this schema and compare that to the old hash. When a user updates their password, create permutations of the new password by taking each digit in the password ...


16

Doesn't this simply reduce the number of possible combinations? yes, but not significantly. As an analogy, consider passwords that are combinations of uppercase letters A-Z only, with max length of 8. Total # of possibilities = 268 + 267 + ... + 26 + 1 = 217.2 billion. If you restrict this to a minimum length of 6, that eliminates passwords of length ...



Only top voted, non community-wiki answers of a minimum length are eligible