New answers tagged

6

They are most likely considering all forms of user input (and need the password to work via other modes such as at an ATM or via phone touch-tone) and therefore limit it to just numbers. Of course the only way to be sure is to have them answer this question, but the scenario is not uncommon with banks that have consolidated remote banking functions onto one ...


1

I'm going to go a different route than all of the other answers so far... and say that at some point, it doesn't matter. The algorithm matter FAR more than the password rules. For example, someone might use ROT13, terrible, yes. Or, get a bit better an use MD5. Or, better yet, SHA-1. Maybe then they add salt. Maybe use crypt(). Maybe then add pepper. Still,...


1

What is worse for password strength, a poor password policy or no password policy at all? That depends on what the poor password policy is. "Your password must be 'letmein'" is a poor password policy that is definitely worse than having no policy at all, since it prevents anybody from having a good password. "Your password must be at least two characters"...


1

If users were picking passwords randomly then password policies would make security worse by limiting the choice of possible passwords but users don't pick passwords randomly. The aim of a good password policy should be to push a user to make more choices and hence choose a stronger password without unduly limiting the password space. This policy has good ...


26

Now I'm wondering what is worse for password strength. Having no password policy at all or a poor password policy like in the picture? The password strength requirements you mentioned absolutely do more harm than good, especially the maximum length. They might be using a very old, insecure hash routine. (thus a max-length) In certain areas, this supports ...


3

None at all is better than the one shown, specifically because of the 8 char limit. All 8 char combos can be tested in a second with a Titan-family GPU and John the Ripper. While not all password policies are detrimental (min length is good, one+ special char forces a bigger crack alphabet, no dictionary words, etc), the one shown is a joke that's not very ...


10

A bad policy like this is worse than none. This policy means that people who normally use '123', will now have a bit more secure password, but it's still weak. It also means that the people using something like 'fzFEZ#5$3rt4564ezezRTyht' (randomly generated), or just: 'cat j_umps over the brown painted wall412' (strong entropy), will now have a much weaker ...


5

in my opinion having none would be better A list of reasons are: These policies make people tend to write down there passwords and stick them to the monitors or alike. (what security does a password than supply?) These rules are easily deduced and (by using these type of boxes) even announced to any potential intruder. (Like lets give the person we want to ...


63

The question is: worse for what? With the policy you posted, the possible passwords are less than 64⁸ (~2.8*10¹⁴). In practice, very much passwords will probably be [a-z]*6[0-9][special char] (e.g. aabaab1!) and similar passwords. All possible passwords with the same characters and length less than 8 are just 64⁷+64⁶+64⁵+... which is ~4.5*10¹². Thats a lot ...


0

Someone can probably do some math and give a really technical answer but like I'd to say it's basically the same but really probably slightly better to have this terrible policy than nothing. People will use their usernames or 3 letter passwords and such. I really think it is important to get it into people's heads that these kind of policies are not ...


5

If it is meant to say, "the first X letters of the password are the same as the first X of the previous password", this is indicative of bad practice. For exactly the reasons you have mentioned. The first X letters may be stored somewhere in plaintext, which is bad - if an attacker gets their hands on them, it makes a brute-force attack simpler. Even ...



Top 50 recent answers are included