Linked Questions

40 votes
14 answers

How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]

I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember. But that seems to be open to dictionary attacks, especially if the attacker has ...
Lichtbringer's user avatar
29 votes
4 answers

Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]

We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
Der Kommissar's user avatar
0 votes
7 answers

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" "...
Drew Lex's user avatar
  • 2,023
5 votes
2 answers

Does brute-force time depend on the length of a password only? [duplicate]

If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
Sup Go's user avatar
  • 59
1 vote
2 answers

Password Security Length vs. Complexity [duplicate]

I am working on a password policy and had some questions about password/passphrase strength: For password strength, is a shorter more complex password stronger or weaker than a much longer, less ...
Verac's user avatar
  • 41
5 votes
3 answers

Why are passwords with special characters considered more secure than longer length passwords? [duplicate]

For example, OWASP considers 10-128 characters, with lower, upper, digit, and special characters (I don't get why there's an upper limit). Using the OWASP's minimum guidelines and assuming there are ...
Geoff Lee's user avatar
  • 149
4 votes
2 answers

How does the password Tr0ub4dor&3 have ~28 bits of entropy? [duplicate]

I rencently seen this : I can't figure out, how he computes 28 bits of entropy for a password like "Tr0ub4dor&3" seems really few...
snoob dogg's user avatar
0 votes
2 answers

Long Passwords: How are they more secure? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? How are long passwords more secure? The only situation in which I can accept long passwords are more secure ...
user avatar
3 votes
4 answers

How effective are password checking websites? [duplicate]

I typed the following password in yummy candy yummy It said it would take 100 billion years for a personal computer to crack. Is this accurate? Even though it has English ...
gloo's user avatar
  • 173
3 votes
1 answer

Why are lengthy passwords stronger than complex ones? [duplicate]

So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to ...
Howdy_McGee's user avatar
0 votes
3 answers

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is '...
user54196's user avatar
4 votes
2 answers

Choose a good password for full disk encryption [duplicate]

I have recently decided to encrypt my Gentoo Linux installation. I am going to use cryptsetup with LVM. LVM filesystem will be placed inside encrypted dm-crypt partition. I have problem with ...
user avatar
1 vote
2 answers

Longer passwords vs Password Composition Rule [duplicate]

Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition ...
Curious's user avatar
  • 21
-3 votes
2 answers

How to make a strong password? [duplicate]

I always hear conflicting things. Should I use a long sentence? Or is this privy to dictionary attacks? Or should I use a long string of random alphanumeric garbage with upper/lowercase and numbers/...
user2175923's user avatar
1 vote
2 answers

Would it better to enforce more complex passwords or passphrases? [duplicate]

I have read in different places that passphrases offer better security and are more user friendly however, I have also read contradictory information thats says longer passwords are not really more ...
Arlix's user avatar
  • 1,489
0 votes
1 answer

Is Entropy all that matters in a Password? [duplicate]

My question is, is it more reliable having a password that is composed by words like FootballPractice more secure than using a password that has only 2 or 3 bits less, for example FootbalPractic , my ...
Magmagod's user avatar
  • 105
1 vote
0 answers

Password Strength: Compound Words [duplicate]

I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength. Dictionary words are an easy target for password crackers. If you compound a ...
Manngo's user avatar
  • 141
-1 votes
2 answers

Creating secure passwords [duplicate]

I have been tasked with writing a random password generator to be used on a series of throw away accounts. In this scenario, the accounts need to be very secure and will be deleted after a single day ...
Fazer87's user avatar
  • 101
1 vote
2 answers

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good to ...
ryno's user avatar
  • 119
-1 votes
2 answers

Should I worry that passphrase length leaks information? [duplicate]

I have been thinking about how to generate random passphrases from a public dictionary of words (similar to XKCD/Diceware passphrases). One thing in particular I was thinking about is that the ...
Guut Boy's user avatar
0 votes
1 answer

Increase entropy by making passphrase more complex [duplicate]

I have just started reading on the use of passphrase to increase a password entropy and have gained a rough understanding of it. However, I'm wondering if it's possible to further increase the entropy ...
weejing's user avatar
  • 161
-2 votes
3 answers

Password security : complexity and length [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? I've read that there is many solutions available to crack passwords. Reading these tips, I can understand ...
Oliver's user avatar
  • 105
-1 votes
1 answer

How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]

Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
Atomic Tripod's user avatar
1 vote
1 answer

Is it secure to choose a password that is a combination of 4 common English words if everyone will do it? [duplicate]

According to this article DropBox recommends using four random common words as a password. I think that it is good if only I do it. If everyone does it, the attackers will always make dictionary ...
Aminadav Glickshtein's user avatar
0 votes
0 answers

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
user510083's user avatar
623 votes
23 answers

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
Bill the Lizard's user avatar
943 votes
11 answers

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.4k
547 votes
11 answers

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
nallenscott's user avatar
  • 4,749
240 votes
10 answers

Is "the oft-cited XKCD scheme [...] no longer good advice"?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
Nick T's user avatar
  • 3,442
298 votes
7 answers

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
Count Zero's user avatar
  • 2,929

15 30 50 per page
2 3 4 5