Linked Questions

21
votes
6answers
8k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
1242
votes
22answers
264k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
893
votes
13answers
281k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
4
votes
1answer
2k views

Should cookies expire?

Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there is no way to visit the page in the clear text. I'm also using a laptop that ...
9
votes
2answers
14k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
33
votes
8answers
6k views

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
2
votes
2answers
464 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
4
votes
3answers
4k views

Why require new users to change password?

I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
0
votes
1answer
171 views

Requiring regular password change counterproductive [duplicate]

According to http://www.csoonline.com/article/3195181/data-protection/vendors-approve-of-nist-password-draft.html "There have been multiple studies that have shown requiring frequent password ...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
11
votes
8answers
5k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
2
votes
4answers
688 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
1
vote
2answers
217 views

Should Administrators regularly change their passwords

CESG state that users should not be forced to undergo regular password changes as it often harms, rather than improves security. Does this logic apply to administrators as well, such as domain admins? ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
4
votes
2answers
378 views

Storing Old Passwords. Bad Security [duplicate]

I have client who is adamant they want to store the last 4 used passwords for every user and force each user to change their password every 6 months to something not used before (i.e not in the last 4 ...

15 30 50 per page