Linked Questions

1197
votes
23answers
246k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
229
votes
10answers
76k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
85
votes
3answers
61k views

Recommended # of rounds for bcrypt

What is nowadays (July 2012) the recommended number of bcrypt rounds for hashing a password for an average website (storing only name, emailaddress and home address, but no creditcard or medical ...
32
votes
8answers
5k views

Are password complexity rules counterproductive?

In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember. I was told that it did not meet complexity rules. After several ...
30
votes
5answers
5k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
19
votes
5answers
7k views

Someone is trying to access my mail account, what safe actions can I take?

Intro I have a free mail account on this (german) website. If I type my password wrong I get, once successfully logged in, a message telling me about my failed log-in attempt. Problem Recently I ...
7
votes
5answers
4k views

Does it really improve a password if at least one character of each group (a-z,A-Z,0-9) is included? [duplicate]

Many password policies required at least one character of each group (upper case, lower case, symbols, and numbers) in the password. Does this really improve a passwords strength? e.g.: Is (number ...
11
votes
2answers
5k views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
0
votes
4answers
726 views

Running SSH on a different port vs adding the port number to a password

So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...
3
votes
3answers
747 views

Does mixing in keystrokes of Backspace, Arrows and Delete add any security to password typing?

It is well known that the analysis of the keyboard sound can reveal/hint at what keys were pressed when a password is typed. One could mix in wrong characters (not belonging to the password) with ...
4
votes
3answers
347 views

how is strength of password calculated from standard keyboard patterns?

In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. ...