Linked Questions

6 votes
4 answers

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
Bengt62's user avatar
  • 71
3 votes
1 answer

Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]

I want to encrypt some data within my php file when I add the stuff to my mysql database. This is how I do it. I create a static key like: $key = md5("pass"); Then I have two functions called ...
Benj Mikesozery's user avatar
0 votes
1 answer

What's the idea behind requiring users to change password periodically? [duplicate]

Possible Duplicate: How does changing your password every 90 days increase security? Some sites require users to change their password every x days. For example, at least 3 online banking system ...
IMB's user avatar
  • 2,958
9 votes
0 answers

What do studies show are best practices for password expiration policies? [duplicate]

Possible Duplicate: How does changing your password every 90 days increase security? What are best practices for password expiration policies? There are some questions that already address this ...
Flimzy's user avatar
  • 676
0 votes
2 answers

Is there any real security benefit to forced password change intervals? [duplicate]

This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well. What is the real security benefit to forcing users to change their password say every 60 days or every ...
James's user avatar
  • 545
0 votes
1 answer

Requiring regular password change counterproductive [duplicate]

According to "There have been multiple studies that have shown requiring frequent password ...
Thomas's user avatar
  • 3,861
-1 votes
1 answer

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
I Stand With Israel's user avatar
1 vote
0 answers

password aging, advantages and disadvantages [duplicate]

What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
Le Kim Trang's user avatar
1285 votes
23 answers

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
941 votes
11 answers

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.1k
37 votes
12 answers

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
user21820's user avatar
  • 623
26 votes
6 answers

Are passwords that are manually typed in really unrecoverable from memory or disk?

As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored ...
chrismarx's user avatar
  • 371
33 votes
8 answers

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
Xenos's user avatar
  • 1,351
27 votes
10 answers

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
Sayan's user avatar
  • 2,043
25 votes
5 answers

Why is "something you know" the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users are ...
Ulkoma's user avatar
  • 8,783

15 30 50 per page