Linked Questions

0
votes
1answer
128 views

Requiring regular password change counterproductive [duplicate]

According to http://www.csoonline.com/article/3195181/data-protection/vendors-approve-of-nist-password-draft.html "There have been multiple studies that have shown requiring frequent password ...
832
votes
13answers
236k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
1196
votes
23answers
246k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
10
votes
8answers
4k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
2
votes
4answers
428 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
2
votes
2answers
188 views

Should Administrators regularly change their passwords

CESG state that users should not be forced to undergo regular password changes as it often harms, rather than improves security. Does this logic apply to administrators as well, such as domain admins? ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
4
votes
2answers
309 views

Storing Old Passwords. Bad Security [duplicate]

I have client who is adamant they want to store the last 4 used passwords for every user and force each user to change their password every 6 months to something not used before (i.e not in the last 4 ...
3
votes
0answers
720 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
8
votes
2answers
11k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
0
votes
2answers
137 views

Is there any real security benefit to forced password change intervals? [duplicate]

This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well. What is the real security benefit to forcing users to change their password say every 60 days or every ...
11
votes
3answers
1k views

Do (uncompromised) passwords ever need changing, if I use a password manager?

For instance, my Google account has a 32-character, random character password that I maintain with LastPass. I regularly flash new ROMs on my phone or otherwise need to be able to manually type in my ...
15
votes
4answers
7k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
10
votes
4answers
1k views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...

15 30 50 per page