Linked Questions
45 questions linked to/from How does changing your password every 90 days increase security?
6
votes
4
answers
2k
views
Why change password? [duplicate]
Why are there recommendations to change passwords with certain intervals?
If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
- 71
3
votes
1
answer
10k
views
Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]
I want to encrypt some data within my php file when I add the stuff to my mysql database.
This is how I do it.
I create a static key like:
$key = md5("pass");
Then I have two functions called ...
0
votes
1
answer
2k
views
What's the idea behind requiring users to change password periodically? [duplicate]
Possible Duplicate:
How does changing your password every 90 days increase security?
Some sites require users to change their password every x days. For example, at least 3 online banking system ...
- 2,978
9
votes
0
answers
465
views
What do studies show are best practices for password expiration policies? [duplicate]
Possible Duplicate:
How does changing your password every 90 days increase security?
What are best practices for password expiration policies?
There are some questions that already address this ...
- 696
0
votes
2
answers
282
views
Is there any real security benefit to forced password change intervals? [duplicate]
This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well.
What is the real security benefit to forcing users to change their password say every 60 days or every ...
- 555
0
votes
1
answer
300
views
Requiring regular password change counterproductive [duplicate]
According to
http://www.csoonline.com/article/3195181/data-protection/vendors-approve-of-nist-password-draft.html
"There have been multiple studies that have shown requiring frequent
password ...
- 3,871
-1
votes
1
answer
214
views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
1
vote
0
answers
108
views
password aging, advantages and disadvantages [duplicate]
What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
- 111
1288
votes
23
answers
292k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
944
votes
11
answers
332k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.6k
36
votes
12
answers
12k
views
Is it acceptable practice to only increment a number when changing a password?
Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
- 612
26
votes
6
answers
7k
views
Are passwords that are manually typed in really unrecoverable from memory or disk?
As part of an increase in the security measures for our company, we're moving to making sure all password logins (databases, servers, etc), are done through a password prompt and never using stored ...
- 371
32
votes
8
answers
6k
views
If password expiration is applied, should door-lock expiration be applied too?
After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
- 1,381
26
votes
10
answers
6k
views
How to strike a balance between security policies and practical implementation challenges? [duplicate]
At our organization, we came across some frequent incidents such as:
Reported successful password guessing attacks
Frequent password reset complaints
We started an investigation to identify the ...
- 2,037
27
votes
5
answers
9k
views
Why is "something you know" the weakest factor of authentication?
Quoting from CompTIA Security+ guide
The first factor of authentication (something you know, such as password or PIN) is the weakest factor.
Why? it makes sense when we say that humans/users are ...
- 8,853
21
votes
6
answers
8k
views
Why use a Smartcard for (Two Factor) Auth instead of another medium?
I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
- 2,408
23
votes
3
answers
9k
views
Why do password creation/login screens hide the typed password?
I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no ...
- 667
30
votes
5
answers
5k
views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
- 1,672
19
votes
6
answers
4k
views
What does "random" mean in the context of password creation?
Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious.
I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
- 411
28
votes
2
answers
5k
views
Does password expiry provide any benefit at all (when using randomly generated passwords)?
I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
- 382
11
votes
8
answers
6k
views
Sequential password updates
Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse.
What's to stop the user from changing the ...
- 2,993
17
votes
3
answers
8k
views
Is forcing users to change passwords useful?
In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
- 569
7
votes
3
answers
3k
views
I found my user details on already old, leaked account information list
I came across an old (>3 years) accounts information list which has been leaked to the web. The list included thousands (>10.000) of account details from a service or services. Apparently the event ...
- 73
15
votes
3
answers
4k
views
How often should passwords change?
I'm asking two very related questions
As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their password ...
- 10.2k
10
votes
2
answers
17k
views
Password expiration and compliance (ISO, NIST, PCI, etc)
I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
- 233
10
votes
4
answers
1k
views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
- 256
12
votes
2
answers
10k
views
After How Much Data Encryption (AES-256) we should change key?
Considering AES-256 encryption, what is the maximum amount of data should be encrypted with one key? Does Block cipher modes/IV/counters also governs the limit?
If say the maximum amount is 50GB, ...
- 415
12
votes
2
answers
3k
views
Requiring regular password change but storing previous passwords?
My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
- 2,978
11
votes
3
answers
1k
views
Do (uncompromised) passwords ever need changing, if I use a password manager?
For instance, my Google account has a 32-character, random character password that I maintain with LastPass.
I regularly flash new ROMs on my phone or otherwise need to be able to manually type in my ...
- 325
4
votes
3
answers
6k
views
Why require new users to change password?
I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
- 2,120
4
votes
4
answers
4k
views
Same password for full disk encryption, user account, admin account
Consider a computer with only 1 user, but 3 passwords:
1 for Full Disk Encryption (FDE)
1 for a user account without administrative rights, which would be the account the user uses everyday
1 for an ...
- 303
5
votes
3
answers
2k
views
Password strength metrics
In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
- 503
5
votes
1
answer
3k
views
Should cookies expire?
Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there is no way to visit the page in the clear text. I'm also using a laptop that ...
- 583
2
votes
2
answers
986
views
What impact do the frequency of password resets have on password reuse?
Wondering if there's any research behind the most common password reset cycle I've seen of 90-days, and if there's any research that gives any insight into how to optimize password resets to reduce ...
- 5,082
1
vote
3
answers
2k
views
Testing a password for similarity to previous hashes
This question is a follow-up to a comment by Tobias Kienzler to an answer to "What is the purpose of the “Password minimum age” setting?".
Consider a password policy that new passwords cannot be ...
- 562
4
votes
2
answers
546
views
Storing Old Passwords. Bad Security [duplicate]
I have client who is adamant they want to store the last 4 used passwords for every user and force each user to change their password every 6 months to something not used before (i.e not in the last 4 ...
- 2,859
2
votes
4
answers
1k
views
Why should we protect access to password hashes?
Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
- 29
1
vote
2
answers
1k
views
How often, if at all, should I rotate my passwords?
In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
user135823
4
votes
1
answer
354
views
Computer team's password change time different from other users?
We need to determine a password policy for our organization.
All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
- 1,085
1
vote
2
answers
345
views
Should Administrators regularly change their passwords
CESG state that users should not be forced to undergo regular password changes as it often harms, rather than improves security. Does this logic apply to administrators as well, such as domain admins?
...
- 71
3
votes
0
answers
837
views
Are enterprises Office 365 accounts overly exposed to brute force attacks?
Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”.
...
- 7,859
3
votes
2
answers
221
views
Assuming proper creation, encryption, and storage, how is a breach/leak of a hash worriesome?
Let's say I create a pseudo-random password that is secure (24 alhpa numeric, upper lower, special chars...) for a system (say a password manager). Let's assume the password manager encrypts and ...
- 3,662
1
vote
2
answers
198
views
Can we simply re-salt password on suspected session hijack?
Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
- 5,897
0
votes
1
answer
296
views
email on hosting company's site hacked?
I have a friend who's has a site hosted by a company in the states.
They think that someone has gotten access to their email account because any requests for support submitted via their website ...
- 101
3
votes
0
answers
300
views
Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]
In my school everyone must change their password every six months.
The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
- 173