Linked Questions

1285 votes
23 answers

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
238 votes
10 answers

Is "the oft-cited XKCD scheme [...] no longer good advice"?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
Nick T's user avatar
  • 3,402
131 votes
3 answers

Recommended # of rounds for bcrypt

What is nowadays (July 2012) the recommended number of bcrypt rounds for hashing a password for an average website (storing only name, emailaddress and home address, but no creditcard or medical ...
Jason Smith's user avatar
  • 1,591
37 votes
8 answers

Why use random characters in passwords?

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
Not_Einstein's user avatar
38 votes
8 answers

Are password complexity rules counterproductive?

In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember. I was told that it did not meet complexity rules. After several ...
IanR's user avatar
  • 491
30 votes
6 answers

Is it insecure to display the number of characters when users enter a new passphrase?

When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system. In a user experience (UX) test I just ran, my user created a ...
colan's user avatar
  • 409
20 votes
4 answers

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
Stephenloky's user avatar
30 votes
5 answers

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
KilledKenny's user avatar
  • 1,672
19 votes
5 answers

Someone is trying to access my mail account, what safe actions can I take?

Intro I have a free mail account on this (german) website. If I type my password wrong I get, once successfully logged in, a message telling me about my failed log-in attempt. Problem Recently I ...
pat3d3r's user avatar
  • 301
8 votes
5 answers

Does it really improve a password if at least one character of each group (a-z,A-Z,0-9) is included? [duplicate]

Many password policies required at least one character of each group (upper case, lower case, symbols, and numbers) in the password. Does this really improve a passwords strength? e.g.: Is (number ...
T. Christiansen's user avatar
11 votes
3 answers

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
Andrew's user avatar
  • 213
7 votes
2 answers

How many bits of entropy should a password have to be reasonably future proof (10+ years)?

I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
abyssalarcanist's user avatar
3 votes
3 answers

Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test

Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
trejder's user avatar
  • 3,619
0 votes
4 answers

Running SSH on a different port vs adding the port number to a password

So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...
David Mulder's user avatar
  • 1,349
4 votes
3 answers

Does mixing in keystrokes of Backspace, Arrows and Delete add any security to password typing?

It is well known that the analysis of the keyboard sound can reveal/hint at what keys were pressed when a password is typed. One could mix in wrong characters (not belonging to the password) with ...
Mindwin Remember Monica's user avatar

15 30 50 per page