Linked Questions

1287 votes
23 answers

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
891 votes
14 answers

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
enderland's user avatar
  • 8,231
475 votes
13 answers

Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's ...
Antoine Pinsard's user avatar
121 votes
11 answers

Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3

TLDR: We already require two-factor authentication for some users. I'm hashing, salting, and doing things to encourage long passphrases. I'm not interested in the merits of password complexity rules ...
Jason Coyne's user avatar
  • 1,593
43 votes
10 answers

What type of pattern should I use for my passwords?

I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging ...
Chris's user avatar
  • 591
40 votes
14 answers

How can I make a strong password that's easy to remember? Is the 4 Word method safe? [duplicate]

I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember. But that seems to be open to dictionary attacks, especially if the attacker has ...
Lichtbringer's user avatar
38 votes
8 answers

Why use random characters in passwords?

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
Not_Einstein's user avatar
15 votes
4 answers

Security of a non-random password but that relies on information an attacker cannot possibly know

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure. To give an example, let’s say that I generate my password by putting ...
hb20007's user avatar
  • 569
7 votes
7 answers

How to choose a good (and easy to use) WiFi password?

Over the last few months I have had to enter WiFi passwords into smart phones, TVs, printers, etc. None of these have real keyboard and they make it hard to enter long passwords or passwords that ...
Ian Ringrose's user avatar
5 votes
8 answers

How should I securely generate random passwords when importing new users?

I need to generate random passwords when importing new users from an external source. I'm currently doing it by taking a random assortment of 8 lowercase/uppercase letters, and numbers. I am also ...
123's user avatar
  • 235
8 votes
4 answers

Can using emojis make someone's password safer?

I was just thinking about this the other day, after reading about making safe passwords, you have a few options: The first would be, adding numbers, or something other than just a word Password15068 ...
knocked loose's user avatar
5 votes
4 answers

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
Bob Ortiz's user avatar
  • 6,715
4 votes
4 answers

password generating algorithm

I read the question about the relevancy of the xkcd password creation algorithm. Would it be more secure if you used a string of common words with a function that only you knew that would rearrange ...
user avatar
2 votes
2 answers

How long would it take a single Processor with the AES-NI Instruction Set to bruteforce an AES Key?

I know that it seems like a stupid question - since it's note feasable to break AES without a quantum computer but I'm curious anyway. I read on wikipedia that the best known attack on AES-128 takes ...
theXs's user avatar
  • 261
2 votes
2 answers

Is it really "Time to add a word" if there are no tools to crack passphrases of 3 words and up?

It's "time to add a word" says Arnold Reinhold, the creator of Diceware, in his blog (3/2014). He advices to use 6 word sentences (or 5 words with one extra character chosen and placed at random) from ...
Dick99999's user avatar
  • 525

15 30 50 per page