Linked Questions

12
votes
2answers
8k views

After How Much Data Encryption (AES-256) we should change key?

Considering AES-256 encryption, what is the maximum amount of data should be encrypted with one key? Does Block cipher modes/IV/counters also governs the limit? If say the maximum amount is 50GB, ...
11
votes
3answers
1k views

Do (uncompromised) passwords ever need changing, if I use a password manager?

For instance, my Google account has a 32-character, random character password that I maintain with LastPass. I regularly flash new ROMs on my phone or otherwise need to be able to manually type in my ...
10
votes
8answers
5k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
10
votes
4answers
1k views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
9
votes
0answers
357 views

What do studies show are best practices for password expiration policies? [duplicate]

Possible Duplicate: How does changing your password every 90 days increase security? What are best practices for password expiration policies? There are some questions that already address this ...
8
votes
3answers
3k views

I found my user details on already old, leaked account information list

I came across an old (>3 years) accounts information list which has been leaked to the web. The list included thousands (>10.000) of account details from a service or services. Apparently the event ...
8
votes
2answers
13k views

Password expiration and compliance (ISO, NIST, PCI, etc)

I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password ...
6
votes
4answers
1k views

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
5
votes
3answers
2k views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
4
votes
3answers
4k views

Why require new users to change password?

I have noticed that it is common practice when setting up a user account (Windows users accounts and Google Apps user accounts in my case) to require new users to create their own password immediately ...
4
votes
2answers
344 views

Storing Old Passwords. Bad Security [duplicate]

I have client who is adamant they want to store the last 4 used passwords for every user and force each user to change their password every 6 months to something not used before (i.e not in the last 4 ...
4
votes
1answer
296 views

Computer team's password change time different from other users?

We need to determine a password policy for our organization. All users, in general, will have 90 days until they will have to change their passwords, complexity required and passwords need to be at ...
4
votes
1answer
2k views

Should cookies expire?

Let's say I have an account on a blog. I'm using https on every single page of that blog through web server rules, so there is no way to visit the page in the clear text. I'm also using a laptop that ...
3
votes
2answers
146 views

Assuming proper creation, encryption, and storage, how is a breach/leak of a hash worriesome?

Let's say I create a pseudo-random password that is secure (24 alhpa numeric, upper lower, special chars...) for a system (say a password manager). Let's assume the password manager encrypts and ...
3
votes
0answers
286 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...

15 30 50 per page