Linked Questions

5
votes
3answers
1k views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last few ...
2
votes
3answers
3k views

Why is there a Cap on Password length? [duplicate]

Why when we sign up on sites like Facebook and Gmail do our passwords have to be 8-12 characters in length, or some other cap? 8-12 spaces are finite, but you can make your passwords more "secure" by ...
4
votes
4answers
441 views

Are limited length passwords a security risk? [duplicate]

I found a webpage where users can be registered. However, it seems that the length of the password must be between 6 to 12 characters. Is that a security risk?
3
votes
1answer
2k views

Why do websites limit password length? [duplicate]

I just made a new account with some eGov service (Belgian government). I use LastPass (which generates long, random strings for each site), But the system told me that the maximum allowed length was ...
0
votes
2answers
346 views

Passwords: Symbols and length > 20 disallowed [duplicate]

I'm going through a bunch of accounts at the moment changing my passwords, some of them are looking a little weak and i've reused them, but i keep coming across websites that don't allow you to use ...
0
votes
1answer
426 views

Recommended length of password [duplicate]

Why are we recommended to have at least 8 characters, and not 6 or 7 etc.? and the different set of character?. I only know that the longer the password is, the harder it is for brute force attack to ...
-1
votes
1answer
141 views

Reasons to limit password length [duplicate]

We are currently using a third party software for SSO Login in a hybrid landscape with SAP, ADFS, etc. The users have to change their password in the client software, which is then sent to a central ...
1
vote
0answers
63 views

Is there a technical reason for a maximum password length rule (15 to 100 characters)? [duplicate]

I've seen on many sites in the registration page that the password should have also a maximum length (between 15 and 100 characters). Except for DDOS attacks, is there a reason for this rule, giving ...
0
votes
0answers
46 views

Why are there password length limitations when the password is stored correctly? [duplicate]

I often (almost always) see that the password i choose in a service is limited (to 16, 30, whatever characters). Are there any reasons for such a limit, provided that it is stored correctly? In such ...
0
votes
0answers
37 views

Banks limiting complexity of passwords? [duplicate]

I was wondering why when I go to setup a bank account do they only let me use upper and lowercase characters and integers, with a limit in regards to the password length? As far as I'm aware the ...
0
votes
0answers
35 views

Does a small max password length indicate there might be a security issue? [duplicate]

Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites ...
831
votes
13answers
234k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
229
votes
10answers
75k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
284
votes
7answers
69k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
163
votes
8answers
37k views

Why is Mother’s Maiden Name still used as a security question?

From time to time, some web sites asks to enter a security question and an answer for it. The question list is standard and it usually includes "What is your mother's maiden name?". Some people use ...

15 30 50 per page