Linked Questions

0
votes
2answers
150 views

Is there any real security benefit to forced password change intervals? [duplicate]

This question is quite basic, but it bugs me and I'm sure it bugs a lot of other people as well. What is the real security benefit to forcing users to change their password say every 60 days or every ...
11
votes
3answers
1k views

Do (uncompromised) passwords ever need changing, if I use a password manager?

For instance, my Google account has a 32-character, random character password that I maintain with LastPass. I regularly flash new ROMs on my phone or otherwise need to be able to manually type in my ...
15
votes
4answers
7k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
10
votes
4answers
1k views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
1
vote
2answers
95 views

Can we simply re-salt password on suspected session hijack?

Looking at people complaining about Yahoo forcing users to change their passwords. We can see that people do not particularly like to change passwords (and whether we change them regularly is an ...
12
votes
2answers
2k views

Requiring regular password change but storing previous passwords?

My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
18
votes
6answers
3k views

What does “random” mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...
23
votes
3answers
7k views

Why do password creation/login screens hide the typed password?

I realize that the concept behind obscuring a password on a screen is to prevent someone "shoulder surfing" behind a user and seeing the typed in password. As a fairly good typist I have no problems ...
36
votes
12answers
10k views

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
5
votes
3answers
2k views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
2
votes
1answer
10k views

Best way to encrypt data using php - I am not sure if I doing it correctly [duplicate]

I want to encrypt some data within my php file when I add the stuff to my mysql database. This is how I do it. I create a static key like: $key = md5("pass"); Then I have two functions called ...
1
vote
0answers
91 views

password aging, advantages and disadvantages [duplicate]

What is the advantages and disadvantages of password aging? Should we apply password aging policies? Thanks a lot.
15
votes
3answers
4k views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their password ...
30
votes
5answers
5k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
8
votes
3answers
3k views

I found my user details on already old, leaked account information list

I came across an old (>3 years) accounts information list which has been leaked to the web. The list included thousands (>10.000) of account details from a service or services. Apparently the event ...

15 30 50 per page