Linked Questions

40 votes
14 answers
19k views

How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]

I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember. But that seems to be open to dictionary attacks, especially if the attacker has ...
Lichtbringer's user avatar
29 votes
4 answers
12k views

Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]

We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
Der Kommissar's user avatar
0 votes
7 answers
4k views

Are passwords made up from concatenating a few foreign words better than shorter random characters? [duplicate]

Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" "...
Drew Lex's user avatar
  • 2,023
5 votes
2 answers
3k views

Does brute-force time depend on the length of a password only? [duplicate]

If a password is +30 characters long but contains words from the dictionary, is it less secure than a 10-character password that is !@#$#%$^%$, for example?
Sup Go's user avatar
  • 59
1 vote
2 answers
8k views

Password Security Length vs. Complexity [duplicate]

I am working on a password policy and had some questions about password/passphrase strength: For password strength, is a shorter more complex password stronger or weaker than a much longer, less ...
Verac's user avatar
  • 41
5 votes
3 answers
14k views

Why are passwords with special characters considered more secure than longer length passwords? [duplicate]

For example, OWASP considers 10-128 characters, with lower, upper, digit, and special characters (I don't get why there's an upper limit). Using the OWASP's minimum guidelines and assuming there are ...
Geoff Lee's user avatar
  • 149
4 votes
2 answers
7k views

How does the password Tr0ub4dor&3 have ~28 bits of entropy? [duplicate]

I rencently seen this : I can't figure out, how he computes 28 bits of entropy for a password like "Tr0ub4dor&3" seems really few...
snoob dogg's user avatar
0 votes
2 answers
5k views

Long Passwords: How are they more secure? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? How are long passwords more secure? The only situation in which I can accept long passwords are more secure ...
user avatar
3 votes
4 answers
956 views

How effective are password checking websites? [duplicate]

I typed the following password in howsecureismypassword.net: yummy candy yummy It said it would take 100 billion years for a personal computer to crack. Is this accurate? Even though it has English ...
gloo's user avatar
  • 173
3 votes
1 answer
1k views

Why are lengthy passwords stronger than complex ones? [duplicate]

So all my life I've been listening to people tell me to make my password complex: upper case / lower case / numeric / symbols. Recently though I've been reading / seeing that length above all seems to ...
Howdy_McGee's user avatar
0 votes
3 answers
2k views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is '...
user54196's user avatar
4 votes
2 answers
2k views

Choose a good password for full disk encryption [duplicate]

I have recently decided to encrypt my Gentoo Linux installation. I am going to use cryptsetup with LVM. LVM filesystem will be placed inside encrypted dm-crypt partition. I have problem with ...
user avatar
1 vote
2 answers
2k views

Longer passwords vs Password Composition Rule [duplicate]

Password composition rule is being considered as a burden for the users and some experts are recommending the increase in the password length instead of enforcing users to comply with the composition ...
Curious's user avatar
  • 21
-3 votes
2 answers
1k views

How to make a strong password? [duplicate]

I always hear conflicting things. Should I use a long sentence? Or is this privy to dictionary attacks? Or should I use a long string of random alphanumeric garbage with upper/lowercase and numbers/...
user2175923's user avatar
1 vote
2 answers
440 views

Would it better to enforce more complex passwords or passphrases? [duplicate]

I have read in different places that passphrases offer better security and are more user friendly however, I have also read contradictory information thats says longer passwords are not really more ...
Arlix's user avatar
  • 1,489
0 votes
1 answer
355 views

Is Entropy all that matters in a Password? [duplicate]

My question is, is it more reliable having a password that is composed by words like FootballPractice more secure than using a password that has only 2 or 3 bits less, for example FootbalPractic , my ...
Magmagod's user avatar
  • 105
1 vote
0 answers
526 views

Password Strength: Compound Words [duplicate]

I’m familiar with XKCD’s Correct Horse Battery Stable example but I am wondering about one aspect of password strength. Dictionary words are an easy target for password crackers. If you compound a ...
Manngo's user avatar
  • 141
-1 votes
2 answers
172 views

Creating secure passwords [duplicate]

I have been tasked with writing a random password generator to be used on a series of throw away accounts. In this scenario, the accounts need to be very secure and will be deleted after a single day ...
Fazer87's user avatar
  • 101
1 vote
2 answers
274 views

is it appropriate to set restrictions on a user's password? [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? Im developing a website and am curious as to the current trends in the nature of passwords. Is it good to ...
ryno's user avatar
  • 119
-1 votes
2 answers
275 views

Should I worry that passphrase length leaks information? [duplicate]

I have been thinking about how to generate random passphrases from a public dictionary of words (similar to XKCD/Diceware passphrases). One thing in particular I was thinking about is that the ...
Guut Boy's user avatar
0 votes
1 answer
291 views

Increase entropy by making passphrase more complex [duplicate]

I have just started reading on the use of passphrase to increase a password entropy and have gained a rough understanding of it. However, I'm wondering if it's possible to further increase the entropy ...
weejing's user avatar
  • 161
-2 votes
3 answers
494 views

Password security : complexity and length [duplicate]

Possible Duplicate: XKCD #936: Short complex password, or long dictionary passphrase? I've read that there is many solutions available to crack passwords. Reading these tips, I can understand ...
Oliver's user avatar
  • 105
-1 votes
1 answer
300 views

How can you calculate the entropy of arbitrary password rules with known distributions? [duplicate]

Many online entropy calculators make certain assumptions (like assuming a password is as rare as the set of random characters that will generate it), or handwave away the math. I want to know how to ...
Atomic Tripod's user avatar
1 vote
1 answer
232 views

Is it secure to choose a password that is a combination of 4 common English words if everyone will do it? [duplicate]

According to this article DropBox recommends using four random common words as a password. I think that it is good if only I do it. If everyone does it, the attackers will always make dictionary ...
Aminadav Glickshtein's user avatar
0 votes
0 answers
35 views

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
user510083's user avatar
624 votes
23 answers
154k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
Bill the Lizard's user avatar
943 votes
11 answers
328k views

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.4k
547 votes
11 answers
95k views

Is my developer's home-brew password security right or wrong, and why?

A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below. His team spent months adopting an industry standard protocol using Bcrypt. ...
nallenscott's user avatar
  • 4,749
240 votes
10 answers
94k views

Is "the oft-cited XKCD scheme [...] no longer good advice"?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
Nick T's user avatar
  • 3,442
298 votes
7 answers
87k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
Count Zero's user avatar
  • 2,929
108 votes
17 answers
25k views

Is "password knocking" a good idea?

With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running. How about password knocking? For example you have three passwords: A, B and C. ...
gronostaj's user avatar
  • 1,300
186 votes
9 answers
26k views

Is the NHS wrong about passwords?

An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
Robin Winslow's user avatar
59 votes
38 answers
13k views

What is your way to create good passwords that can actually be remembered?

What are the methodologies which can be used to generate "human" good quality password? They have to ensure a good strength and also easy to remember for a human being.
121 votes
11 answers
26k views

Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3

TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
Jason Coyne's user avatar
  • 1,593
88 votes
12 answers
27k views

IT will only give password over phone - but is that really more secure than email?

Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
Chris Cirefice's user avatar
137 votes
7 answers
21k views

Internet courtship: Why would a hacker buy me poker chips?

Believe me, I never expected to ever write a title like that on a Stack Exchange site either! Yesterday evening I got a call from my mother. She is quite tech savvy and generally knows her way around ...
Bram Vanroy's user avatar
92 votes
11 answers
16k views

Is there a threshold for a password so long it doesn't get any more secure or even becomes insecure?

I always hear "A long password is good, a longer password is better". But is there such a thing as a "Password is so long it is becoming unsafe" or "Password is long enough, making it longer won't ...
Mindwin Remember Monica's user avatar
75 votes
11 answers
16k views

Will typing my password twice make it more secure? Or typing each character twice?

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is? Assume that it is already 8 ...
user avatar
74 votes
13 answers
17k views

How reliable is a password strength checker?

I've tested the tool from Microsoft available here which tests password strength and rates them. For a password such as "i am going to have lunch tonight", the tool rates it's strength as "BEST" and ...
iijj's user avatar
  • 749
50 votes
13 answers
19k views

Is there a good way to store credentials outside of a password manager?

A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management ...
Hajar Qh's user avatar
  • 589
169 votes
5 answers
11k views

Password management for kids - what's a good way to start?

Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords? An example to make things ...
Chris H's user avatar
  • 4,435
56 votes
11 answers
12k views

Why are static password requirements used so frequently?

Wouldn't it be smarter to measure password entropy and reject low entropy passwords? This would allow short passwords using the whole character set to pass, aswell as long passwords only using parts ...
HopefullyHelpful's user avatar
64 votes
11 answers
13k views

Why does the user pick the password?

Almost every web service I can imagine has the user pick the password. Why is this? Couldn't the system choose a better password? It doesn't have to be some complicated mess; see this answer. Do ...
Christopher King's user avatar
79 votes
4 answers
18k views

Why add username to salt before hashing a password?

I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
JustinLovinger's user avatar
30 votes
11 answers
12k views

Why are passwords generated by a password generator a complicated mix of letters and numbers instead of a long phrase?

E.g. if I were to register for a new website and am prompted for a password, my browser might generate a complicated password that looks like uv^2<YGYy}#Vj}=f which might be impossible to crack but ...
Allure's user avatar
  • 499
54 votes
11 answers
8k views

Is there a method of generating site-specific passwords which can be executed in my own head?

I was thinking recently about password security. My goal is to have mostly random passwords, that are different for each site. But you also should be able to remember them (or re-generate them) ...
Mnementh's user avatar
  • 803
44 votes
6 answers
33k views

Length of passwords that are rainbow table safe

With large computing power (like what you can get in the Amazon cloud for example) you can generate huge rainbow tables for passwords. There also seems to be some large rainbow tables reachable that ...
rubo77's user avatar
  • 2,390
52 votes
5 answers
11k views

How can I know that developers will be ethical and not record my password in plaintext

I am not asking why hashing should be done. Instead, I want to know how to prevent that developers record user passwords to hack their user's other accounts, especially their email. Couldn't they ...
poush's user avatar
  • 625
35 votes
12 answers
27k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
student's user avatar
  • 1,473
39 votes
8 answers
7k views

Are password complexity rules counterproductive?

In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember. I was told that it did not meet complexity rules. After several ...
IanR's user avatar
  • 501

15 30 50 per page
1
2 3 4 5