Tag Info

New answers tagged

4

I agree with the other answers that the "security questions" really don't do much good. The theory behind them is that only you will know the answers to those questions, and they will be used to let you back in to your account should you have forgotten your password. Unfortunately, the answers to most security questions can be found online if the attacker ...


2

Security question is actually a misnomer as it doesn't really improve security of an account but is more like having a back door to the house. You don't have a key (password) to the front door, no problem, enter from the back if you know the number to open the combination lock. That said, the method you proposed is akin to requiring the same key for the ...


7

I generally dislike security questions in general; they usually ask for information that is more or less public. Mother's maiden name? Ancestry.com will tell you that. Your high school? Facebook, LinkedIn, any of a number of social media sites that use the info to suggest potential friends will not only have it, they'll advertise it if you aren't careful ...


9

These user names requirement can cause user names to be less predictable. I don't think that this provides a substantial security improvement, but I can think of a couple of scenarios where they help a little. I doubt that it offsets the loss of usability, but I lack concrete evidence to conclude. As usual, security at the expense of usability, comes at the ...


3

I agree that forcing a weird username will make breaking the account sligthly harder (as it works as a kind of second password) as opposed to having the same username as in the XYZ account whose password they are reusing. (But imposing some requirements also makes easier that the user forgets his own username!) The main reason I see for setting a minimum ...


4

To make user IDs less predictable. To conform to other systems. The reasons for less predictable user IDs might be: An application limits a number of password guesses (a typical thing for internet banking) per a user ID. Then an attacker can mount an attack "try password 123456 for all known user IDs". If the attacker does not know the large amount of ...


25

There are two main arguments for enforcing requirements/restrictions on username choices. The first is that making usernames more difficult for attackers to predict helps resist online guessing attacks. While usernames aren't necessarily considered to be as secret as passwords they are one of at least two pieces of information that must be stolen to ...


1

The other answers have touched on pieces of the puzzle, but the high level view is this: All of security boils down to risk assessment, risk management, and risk mitigation. Because of this, there is no generic answer for your question. Here are some of the sorts of things you need to look at to determine whether or not this practice is acceptable in ...


3

It is all a matter of trust and/or accountability. If your internal environment is completely secure/separated from the internet you can, but it is not generally a good idea. Example: What happens if an employee is let go? Can you trust that person then? If attached to the internet that is very bad and I have seen it happen in companies I have worked for ...


0

Password reuse is probably the best strategy for making you able to remember all your passwords without storage. Storing random and strong passwords still is probably a better thing to do, though -- just make sure you can access this storage if your primary device goes missing or stolen. If you want to go down the path of password reuse, you can do it ...



Top 50 recent answers are included