Tag Info

Hot answers tagged

712

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked. Soon, the chimps learn that the bananas and the stepladder ...


209

It's a leftover from the time when keypads didn't have the letters Q and Z. Security-wise, there's no reason. It's just because of old systems. To clarify: You used to be able to enter your password over the phone. Some phones didn't have the letters Q or Z, like the one on the picture below. Image courtesy: Bill Bradford on flickr.com Because of ...


99

These restrictions are often put in place for various reasons: Interaction with legacy systems that do not support long passwords. Convention (i.e. "we've always done it that way") Simple naivety or ignorance. As far as security goes, there is no need to limit password lengths. They should be hashed anyway, using a KDF such as bcrypt. To help with ...


91

If you do not divulge your "password requirements" then your users will hate you. Some will not succeed in finding an "acceptable password" and will call the helpdesk. Or, worse, if the users are customers then they will go buy elsewhere. A great way to kill your own business ! On the other hand, if divulging your "password requirements" really help ...


81

Salted hashes are designed to protect against attackers being able to attack multiple hashes simultaneously or build rainbow tables of pre-calculated hash values. That is all. They do nothing to improve the underlying strength of the password itself, weak or strong. This also means that they're not designed to defend against online attacks, so they ...


67

I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought. Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of ...


47

You see that thing up there where it displays your username? They can't do that if the username is stored hashed now can they? One word, usability.


41

As Mike and Gumbo have mentioned in comments, a salt isn't intended to add protection to bad passwords. It's meant to keep the attackers from breaking the whole database at once. The length of the salt isn't meant to add difficulty to breaking the stored passwords. It's meant to ensure that your salt is reasonably unique compared to others on the Internet, ...


37

Microsoft already has done something like this with their product key alphabet. They selected a subset of characters that are distinctive, and excluded characters that could lead to either confusion or offensive words. The 24 used are: 2346789BCDFGHJKMPQRTVWXY The 12 unused are: 015AEILNOSUZ The hyphen character is used to separate five character groups, ...


35

If they store it in plaintext or encrypted plaintext, then that's probably the maximum value that can be stored in the DB. On the other hand one should get as far as possible from these sites To avoid DOS attacks. This is usually if they have a very high limit, like 512 or 1024 bytes To comply with regulations that are actually made by people not knowing ...


35

Sending you the password in plain text does not necessarily mean the database stores it in plain text, especially if they sent you the email before encrypting and storing the password. However if you ask for the password later on (e.g "forgot password" mechanism) and they do send it to you like this, it implies that they are either storing in plain text or ...


34

You can't allow customers to be on the same network as your own computers. A lot of new WiFi access-points take care of this for you, by creating two wifi networks, where the "guest" network does not have access to internal computers. The Cisco/Linksys 4200 is what I have at home for guests, and it's easy to setup, but there are many other systems that have ...


34

You have to consider two attack vectors: Online attack Offline attack Limiting login guessing helps against Online attacks. Let's say it's three times, this means that an attacker can test ALL accounts for the three most common passwords that fit your password policy (how about "password", "12345678" and "12345"?). Salting helps against Offline attacks ...


33

The real reason why such policies are in place is because they are in place by default. That's how things go in Active Directory: Passwords expire after 42 days. When changing his password, the (non-admin) user cannot reuse one of his 24 previous passwords. User cannot change his password twice within the same 24-hour frame. So you will encounter such ...


32

The long password recommendation is to protect passwords from being cracked if someone has access to the hash of that password. Tools like hashcat can easily (using gpu) test 93800M c/s md5 hashes As a user usually you don't know how does the site stores your password so it is better to use a long password to mitigate those attacks.


30

Logging the value of a failed password attempt (cleartext or otherwise) seems like a security anti-pattern. I've never seen a web app that does this, and I'm not aware of any default system services such as SSH that do either. As pointed out by @tylerl below, most systems simply log meta-information about an access attempt (e.g. username, time, perhaps IP ...


29

The following doesn't really do this justice, but in summary... In an ideal world no, complicated passwords should not be required for online resources. But, in that ideal world we are dependent on the administrators of the system to harden systems to prevent unauthorised access to the 'password file', the following will minimise the risk: Securely ...


29

Picking good passwords is hard. Humans and our penchant for patterns simply aren't very good at it. Multiply that by the dozens of accounts we accumulate over time, and this is the root of the problem. So yes, eliminating bad passwords and password reuse can solve the problem of creating soft targets, but it doesn't solve the root problem of ...


26

Because, as LinkedIn and other recent password leakages reveal, still the most common passwords for websites are "password", "god", "123456", etc. So you can brute-force with really short list of most common passwords. Still, you can just ban those passwords, or require long password - as possible combinations grow exponentially with the length, and ...


26

You should salt and hash the password instead of storing it in clear text. The hash function will result in a constant output size regardless of the length of the input string. Using a minimum length and perhaps some other quality rules is a good idea because it helps a little against laziness. If you are afraid of Denial of Service attacks, you could put ...


26

There are two main arguments for enforcing requirements/restrictions on username choices. The first is that making usernames more difficult for attackers to predict helps resist online guessing attacks. While usernames aren't necessarily considered to be as secret as passwords they are one of at least two pieces of information that must be stolen to ...


25

Leading and trailing spaces could be trouble for people who are loose with copy and paste. Otherwise, agreed with the other posts, no good reason. Although, what other characters are we blocking? tab, cr, lf, backspace, beep ☻☺♪▬♣. ?


25

If you don't tell the user exactly what's needed in his password to go through the validation of your function, how would he know what to add or modify to make it valid? Giving such information could result in making a bruteforce attack easier. However, considering your requirements, it doesn't help the attacker at all because there are too many password ...


24

I would cite an attempt to reduce customer service related issues. The larger and more complex a passwords is the higher the likelihood for the customer to enter invalid password, get locked out and then contact customer service tying up that individual's time. It is amazing how many people are unable to accurately type a normal weak password, let alone ...


24

You cannot answer this question without answering the following question If a user's password is compromised, does that only put that user/that user's data at risk, or does it also put other users at risk? If the system does not compartmentalize accounts, then a user cannot keep their data safe by choosing appropriate credentials, so administrators ...


24

Typically it is used in combination with a password history policy, eg “you can't re-use any of your last 12 passwords”. Without a minimum-change-period it would be possible to circumvent this by changing your password 12 times in a row, back to the original. It is IMO of pretty doubtful value.


23

There are a few reasons that limits might have been imposed: Some developers feel that reasonable limits (e.g. 120 chars) help reduce server load for hashing ludicrously sized passwords. In reality, the transfer overheads are probably more intensive, as the data is reduced down to a fixed length state in the first round of most hashes, so it's a rather ...


22

Would be great if the answer contains some calculations which estimate the password security and some references about this topic. I very recently answered almost the exact same question here: Confused about (password) entropy The time it takes to crack your password is exactly equal to the amount of time it takes to test a single password multiplied ...


22

While what Terry is saying is true, sometimes login systems actually hash the username (but without salt). They have you pick a log in name and a display name. The logging name is stored hashed (without salt because you need to be able to look it up) and the password gets salted. The display name is different from your login name (because this should be kept ...


21

No (with a minor exception at the bottom). The passphrases "correct horse battery staple" and "correcthorsebatterystaple" are equivalent entropy-wise. Choosing to put spaces in an incorrect spot or sometimes including spaces and sometimes not including spaces will give you a few extra bits of entropy; but its not worth it for the extra difficulty ...



Only top voted, non community-wiki answers of a minimum length are eligible