Linked Questions
45 questions linked to/from How does changing your password every 90 days increase security?
6
votes
4
answers
2k
views
Why change password? [duplicate]
Why are there recommendations to change passwords with certain intervals?
If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
- 71
3
votes
1
answer
10k
views
Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]
I want to encrypt some data within my php file when I add the stuff to my mysql database.
This is how I do it.
I create a static key like:
$key = md5("pass");
Then I have two functions called ...
0
votes
1
answer
2k
views
What's the idea behind requiring users to change password periodically? [duplicate]
Possible Duplicate:
How does changing your password every 90 days increase security?
Some sites require users to change their password every x days. For example, at least 3 online banking system ...
- 2,978
9
votes
0
answers
465
views
What do studies show are best practices for password expiration policies? [duplicate]
Possible Duplicate:
How does changing your password every 90 days increase security?
What are best practices for password expiration policies?
There are some questions that already address this ...
- 696
0
votes
2
answers
282
views
Is there any real security benefit to forced password change intervals? [duplicate]
This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well.
What is the real security benefit to forcing users to change their password say every 60 days or every ...
- 555
0
votes
1
answer
300
views
Requiring regular password change counterproductive [duplicate]
According to
http://www.csoonline.com/article/3195181/data-protection/vendors-approve-of-nist-password-draft.html
"There have been multiple studies that have shown requiring frequent
password ...
- 3,871
-1
votes
1
answer
214
views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
1
vote
0
answers
108
views
password aging, advantages and disadvantages [duplicate]
What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
- 111
1288
votes
23
answers
292k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
944
votes
11
answers
332k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.6k
36
votes
12
answers
12k
views
Is it acceptable practice to only increment a number when changing a password?
Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
- 612
26
votes
6
answers
7k
views
Are passwords that are manually typed in really unrecoverable from memory or disk?
As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored ...
- 371
32
votes
8
answers
6k
views
If password expiration is applied, should door-lock expiration be applied too?
After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
- 1,381
26
votes
10
answers
6k
views
How to strike a balance between security policies and practical implementation challenges? [duplicate]
At our organization, we came across some frequent incidents such as:
Reported successful password guessing attacks
Frequent password reset complaints
We started an investigation to identify the ...
- 2,037
27
votes
5
answers
9k
views
Why is "something you know" the weakest factor of authentication?
Quoting from CompTIA Security+ guide
The first factor of authentication (something you know, such as password or PIN) is the weakest factor.
Why? it makes sense when we say that humans/users are ...
- 8,853