Timeline for Regulations that specify password length?
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Jun 28, 2018 at 22:57 | history | edited | AndrolGenhald | CC BY-SA 4.0 |
removed duplicate words
|
| S Jun 28, 2018 at 22:57 | history | suggested | jkdba | CC BY-SA 4.0 |
removed duplicate words
|
| Jun 28, 2018 at 21:18 | review | Suggested edits | |||
| S Jun 28, 2018 at 22:57 | |||||
| Feb 12, 2013 at 20:28 | comment | added | Mike | @Rook Good point. However hashing a 15 character password or a 1000 char password isn't going to really make a big difference. But I guess there should be SOME limit enforced, just nothing even close to being in the range of what 99.99% of normal users would provide. | |
| Feb 12, 2013 at 19:34 | comment | added | rook | @Mike Hash functions are heavy (and KDF functions for passwords are the heaviest of hash functions), if you supply an excessively large string you will consume resources, which is ripe for a DDoS. | |
| Feb 12, 2013 at 18:08 | comment | added | Mike | How on earth does a maximum password length improve security under any circumstances? Just yesterday I was changing my live.com password and they give you all this stuff about security being so important to them blah blah blah, but then they cap password lengths at 15 characters. | |
| Jan 27, 2012 at 19:19 | history | edited | rook | CC BY-SA 3.0 |
added 7 characters in body
|
| Jan 18, 2012 at 17:21 | comment | added | Jim B | @Rook +1 PCI has almost nothing to do with security its a standard for auditors to decided whom to blame. | |
| Jan 18, 2012 at 10:54 | comment | added | Lucas Kauffman | Some things which are also not taking into account is that when users need to change their password regularly they often use patterns or just write their password down next to their desk. | |
| Jan 18, 2012 at 7:20 | comment | added | rook | @schroeder The PCI-DSS is really ambiguous especially when it comes to cryptography. This was a standard created to place blame on vendors when things go wrong, and it doesn't really care if your system is secure. | |
| Jan 18, 2012 at 2:51 | comment | added | schroeder♦ | Right. SOX, AR 25-3, and ISO 27001 all state that there needs to be a minimum and maximum enforced, but just the PCI-DSS that actually says what the minimum should be. | |
| Jan 18, 2012 at 2:00 | history | answered | rook | CC BY-SA 3.0 |