Tag Info

Hot answers tagged

616

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked. Soon, the chimps learn that the bananas and the stepladder ...


87

These restrictions are often put in place for various reasons: Interaction with legacy systems that do not support long passwords. Convention (i.e. "we've always done it that way") Simple naivety or ignorance. As far as security goes, there is no need to limit password lengths. They should be hashed anyway, using a KDF such as bcrypt. To help with ...


85

If you do not divulge your "password requirements" then your users will hate you. Some will not succeed in finding an "acceptable password" and will call the helpdesk. Or, worse, if the users are customers then they will go buy elsewhere. A great way to kill your own business ! On the other hand, if divulging your "password requirements" really help ...


58

I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought. Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of ...


36

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


33

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


31

The real reason why such policies are in place is because they are in place by default. That's how things go in Active Directory: Passwords expire after 42 days. When changing his password, the (non-admin) user cannot reuse one of his 24 previous passwords. User cannot change his password twice within the same 24-hour frame. So you will encounter such ...


29

If they store it in plaintext or encrypted plaintext, then that's probably the maximum value that can be stored in the DB. On the other hand one should get as far as possible from these sites To avoid DOS attacks. This is usually if they have a very high limit, like 512 or 1024 bytes To comply with regulations that are actually made by people not knowing ...


26

Because, as LinkedIn and other recent password leakages reveal, still the most common passwords for websites are "password", "god", "123456", etc. So you can brute-force with really short list of most common passwords. Still, you can just ban those passwords, or require long password - as possible combinations grow exponentially with the length, and ...


25

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP ...


24

You should salt and hash the password instead of storing it in clear text. The hash function will result in a constant output size regardless of the length of the input string. Using a minimum length and perhaps some other quality rules is a good idea because it helps a little against laziness. If you are afraid of Denial of Service attacks, you could put ...


23

If you don't tell the user exactly what's needed in his password to go through the validation of your function, how would he know what to add or modify to make it valid? Giving such information could result in making a bruteforce attack easier. However, considering your requirements, it doesn't help the attacker at all because there are too many password ...


22

While what Terry is saying is true, sometimes login systems actually hash the username (but without salt). They have you pick a log in name and a display name. The logging name is stored hashed (without salt because you need to be able to look it up) and the password gets salted. The display name is different from your login name (because this should be kept ...


22

Typically it is used in combination with a password history policy, eg “you can't re-use any of your last 12 passwords”. Without a minimum-change-period it would be possible to circumvent this by changing your password 12 times in a row, back to the original. It is IMO of pretty doubtful value.


22

There are a few reasons that limits might have been imposed: Some developers feel that reasonable limits (e.g. 120 chars) help reduce server load for hashing ludicrously sized passwords. In reality, the transfer overheads are probably more intensive, as the data is reduced down to a fixed length state in the first round of most hashes, so it's a rather ...


21

I would cite an attempt to reduce customer service related issues. The larger and more complex a passwords is the higher the likelihood for the customer to enter invalid password, get locked out and then contact customer service tying up that individual's time. It is amazing how many people are unable to accurately type a normal weak password, let alone ...


21

Yes you are right. Using a pool of passwords is definitely recommended but the passwords should not follow a pattern (at least not the one suggested by intel) but that is how we think (we are security guys). May be the writer was thinking from a common user's point of view because most common users simply don't want to take the headache of remembering ...


20

No (with a minor exception at the bottom). The passphrases "correct horse battery staple" and "correcthorsebatterystaple" are equivalent entropy-wise. Choosing to put spaces in an incorrect spot or sometimes including spaces and sometimes not including spaces will give you a few extra bits of entropy; but its not worth it for the extra difficulty ...


20

Would be great if the answer contains some calculations which estimate the password security and some references about this topic. I very recently answered almost the exact same question here: Confused about (password) entropy The time it takes to crack your password is exactly equal to the amount of time it takes to test a single password multiplied ...


19

You cannot answer this question without answering the following question If a user's password is compromised, does that only put that user/that user's data at risk, or does it also put other users at risk? If the system does not compartmentalize accounts, then a user cannot keep their data safe by choosing appropriate credentials, so administrators ...


19

One explanation I haven't seen here is that many financial institutions are tightly integrated with older systems and are bound to the limitations of those systems. The irony of this is that I have seen systems that were built to be compatible to older systems but now the older systems are gone and the policy still must exist for compatibility with the ...


18

If the length of the hash varies depending on input, then it is not a hash. A cryptographic hash function, by definition, offers a fixed-size output, regardless of the input. For instance, SHA-256 offers a 256-bit output, always; never more and never less. Password hashing is a specific activity which is often discussed in this site. The short answer is: ...


17

Is it safe for a small business to let customers use their wifi while waiting? No. Even if no customer intentionally attacks his WiFi network they could be carrying some type of malware on their laptop/smart phone/portable device that might spread. Additionally the WiFi signal doesn't end at the front door. You have probably connected to a WiFi some ...


16

My recommendation: 1,024 bytes. The limitation on password sizes is a limitation that existed for reasons of obsolete technical requirements. Modern password storage should rely on hashing which makes the password storage field a fixed size regardless of the password length. We don't want to see 1mb passwords as that would simply indicate somebody trying to ...


16

Doesn't this simply reduce the number of possible combinations? yes, but not significantly. As an analogy, consider passwords that are combinations of uppercase letters A-Z only, with max length of 8. Total # of possibilities = 268 + 267 + ... + 26 + 1 = 217.2 billion. If you restrict this to a minimum length of 6, that eliminates passwords of length ...


16

Spaces in a passphrase add entropy exactly insofar that they could not have been added. An important point is that an attacker cannot test for a partial match on a password; contrary to what Hollywood movies tend to suggest (in a most graphic way), there is no such thing as a "partial decryption" (where the text is partly legible, but blurred) or a "partial ...


16

There is a basic rule when considering hashing passwords and other secret-keeping within an application: The attacker knows everything the application knows. So in this case, you don't gain anything, since the attacker can simply remove your obfuscation and then go about cracking your passwords directly. The same goes for: "secret" salts custom ...


15

Users/customers will most likely restrain from using your service once their third attempt at entering a valid password failed. Hackers in contrast will try to register arbitrarily often to figure out your password requirements as precise as possible. To counter this, validate the user first via the usual means (email, captcha etc) and send them a password ...


14

Letting guest coming on your network is not a good idea. But this has already been said. A major point that must must remarked is that even for guest you need identification and authentication. In fact (I am not aware of you laws) you want to make sure to be able to track back any user of your WiFi in case of a problem with justice. If someone comes to tell ...


14

The first question is: why do some services require passwords to be periodically changed. The answer is "Risk Mitigation". Corporate governance requires IT security policies to be defined in accordance to a risk management plan. One of the question that risk management plans ask is how can one mitigate a risk if it occurs. In the context of passwords, the ...



Only top voted, non community-wiki answers of a minimum length are eligible