Tag Info

New answers tagged

30

In addition to the password policy (upper case+lower case letters, number, non alphanumeric character, >8 digits), it also leads to clarity. Some users might be confused by the password being password, depending how it's displayed, especially if it's mixed with other information. Yet for all but the mentally challenged users it's immediately clear that ...


0

It is simply trying to stop people getting round the minimum length rule by appending characters. e.g. aB3 is not accepted because I need eight characters, therefore I'll use aB3xxxxx. Rules like this are simply a losing battle for the site owners. They should be encouraging and advising users how to choose strong passwords, rather than enforcing rules ...


0

I believe it is more accurate to say that it's a technique to ensure a level entropy. This can be commonly identified by the N-GRAM technique for predicting text/speech. This is a method based on probability that a pattern will repeat. I would assume you can reduce your computational brute forcing if you can successfully predict when a users is going to ...


2

The site you point to is a site for developer tools, and specifically VMs created for the sole purpose of testing different versions of IE. Casually released developer tools like this normally are given far less scrutiny, and are less polished than a full release of a major product. There's really no good reason why Passw0rd! is any more secure than ...


15

Depending on how the virtual machine is configured, the password complexity may be a requirement that's enforced by the system's security settings. On the virtual machine, run secpol.msc. Navigate to: Security Settings\Account Policies\Password Policy Observe the value for "Password must meet complexity requirements" By default, standalone systems have ...


29

Password policy. You have to jump trough some hoops to get Windows to accept "password" (no capitals, no digits, no non-alphanumerics). But it will accept "Passw0rd!" right out of the box.


58

Reason may be: This Windows has implemented a strong password policy, thus the user MUST HAVE a "strong" password.


1

This rule does not make much sense. I believe the rationale between this rule is to avoid people padding their short passwords with repetition of a character (which is a pattern, hence identifiable by password crackers) to meet the minimum length, instead of entering different characters to create a more complex password. E.g. if the user enters Jane1 as a ...


0

The biggest problem I see is that it doesn't help against offline attacks, or it hurts them. You had better be salting and hashing the password, or else you're dramatically weakening the password security. And if you're doing that, then this has to be done by an external call, and all that remains is security by obscurity.


2

The only reason I can think of, is the case when the password is meant to be changed and they want to indicate to the users that they should use a complex password.


3

This is not a good idea. I would also like to quote the question: I still feel like most people are probably using a password that is the required length or only 1 or 2 characters over the limit. Agree! Well, I don't actually assume people to create passwords of one or two characters if you set the minimum length to 0, but most of your unrestricted ...


52

One related question that you missed in your list is this one: How critical is it to keep your password length secret? The accepted answer there (disclaimer: mine) shows that if you have a password scheme which allows all 95 printable ascii characters, then the key space ramps insanely quickly every time you increase the length of the password by 1. You ...


13

The answer is in your question. Assuming the use of only alphanumeric characters, requiring 8+ characters removes about 3.5 trillion password possibilities (most of them would just be random gibberish). This leaves ~13 quadrillion passwords that are 8-9 characters. Establishing a minimum length, or even an exact length, for passwords forces the user to ...


4

Not uniformly applying a password policy introduces unnecessary security risks and definitely does not improve security. Allowing weak passwords to exist just improves the likelihood that the attacker will crack a hash using a list of common passwords. This problem is made worse as the number of users increases. If 1/100 accounts have a password that ...


2

No, this does not indicate whether they are storing your password in plain text or with reversible encryption. They might be, but this still leaves other possibilities open. All you know for certain is that they created a new password and emailed that new password to you. That password may well be hashed appropriately for storage in their system. However; ...


1

Not necessarily, I don't see an immediate correlation between the two. What is probably happening is that the application got your plain text password from the POST request and sent it to you as a reminder. It is likely that they are not retaining the plain text version and that they are keeping its hash instead. If, on the other hand, you haven't typed ...


2

Some thoughts: I would look to the Blackberry 10 lock screen for inspiration. They are already doing something very similar; as far as I've used it, you set up a number (say "9") and a point on your background image (say the center of the padlock). At login you are given a randomized grid of numbers then, by grabbing anywhere on the screen, you drag the ...


2

I suggest Fail2ban on all SSH servers, especially with inexperienced users. This lets you block any IP that fails to log in too often (iirc, the default is 10 tries in 10 minutes gets an IP blocked for 10 minutes). This may now be possible with just OpenSSH via MaxAuthTries, MaxSessions, and MaxStartups. In addition to that, I'd suggest regularly running ...



Top 50 recent answers are included