Linked Questions

1221
votes
23answers
255k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
861
votes
13answers
259k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
4
votes
1answer
2k views

Should cookies expire?

Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there is no way to visit the page in the clear text. I'm also using a laptop that ...
8
votes
2answers
13k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
33
votes
8answers
6k views

If password expiration is applied, should door-lock expiration be applied too?

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door ...
2
votes
2answers
290 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
4
votes
3answers
4k views

Why require new users to change password?

I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
0
votes
1answer
146 views

Requiring regular password change counterproductive [duplicate]

According to http://www.csoonline.com/article/3195181/data-protection/vendors-approve-of-nist-password-draft.html "There have been multiple studies that have shown requiring frequent password ...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
10
votes
8answers
5k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
2
votes
4answers
565 views

Why should we protect access to password hashes?

Why should we protect the access to the password hashes? And under what conditions can this precaution be omitted?
1
vote
2answers
202 views

Should Administrators regularly change their passwords

CESG state that users should not be forced to undergo regular password changes as it often harms, rather than improves security. Does this logic apply to administrators as well, such as domain admins? ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
4
votes
2answers
337 views

Storing Old Passwords. Bad Security [duplicate]

I have client who is adamant they want to store the last 4 used passwords for every user and force each user to change their password every 6 months to something not used before (i.e not in the last 4 ...
3
votes
0answers
751 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...

15 30 50 per page