Linked Questions
45 questions linked to/from How does changing your password every 90 days increase security?
21
votes
6
answers
8k
views
Why use a Smartcard for (Two Factor) Auth instead of another medium?
I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
- 2,408
23
votes
3
answers
9k
views
Why do password creation/login screens hide the typed password?
I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no ...
- 667
30
votes
5
answers
5k
views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
- 1,672
19
votes
6
answers
4k
views
What does "random" mean in the context of password creation?
Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious.
I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
- 411
28
votes
2
answers
5k
views
Does password expiry provide any benefit at all (when using randomly generated passwords)?
I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
- 382
11
votes
8
answers
6k
views
Sequential password updates
Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse.
What's to stop the user from changing the ...
- 2,993
17
votes
3
answers
8k
views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
- 569
7
votes
3
answers
3k
views
I found my user details on already old, leaked account information list
I came across an old (>3 years) accounts information list which has been leaked to the web. The list included thousands (>10.000) of account details from a service or services. Apparently the event ...
- 73
15
votes
3
answers
4k
views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their password ...
- 10.2k
10
votes
2
answers
17k
views
Password expiration and compliance (ISO, NIST, PCI, etc)
I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
- 233
10
votes
4
answers
1k
views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
- 256
12
votes
2
answers
10k
views
After How Much Data Encryption (AES-256) we should change key?
Considering AES-256 encryption, what is the maximum amount of data should be encrypted with one key? Does Block cipher modes/IV/counters also governs the limit?
If say the maximum amount is 50GB, ...
- 415
12
votes
2
answers
3k
views
Requiring regular password change but storing previous passwords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
- 2,978
11
votes
3
answers
1k
views
Do (uncompromised) passwords ever need changing, if I use a password manager?
For instance, my Google account has a 32-character, random character password that I maintain with LastPass.
I regularly flash new ROMs on my phone or otherwise need to be able to manually type in my ...
- 325
4
votes
3
answers
6k
views
Why require new users to change password?
I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
- 2,120