Linked Questions
19 questions linked to/from Password rules: Should I disallow "leetspeak" dictionary passwords like XKCD's Tr0ub4dor&3
1285
votes
23
answers
285k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
238
votes
10
answers
93k
views
Is "the oft-cited XKCD scheme [...] no longer good advice"?
I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead.
Modern password crackers combine different words from their ...
- 3,402
131
votes
3
answers
141k
views
Recommended # of rounds for bcrypt
What is nowadays (July 2012) the recommended number of bcrypt rounds for hashing a password for an average website (storing only name, emailaddress and home address, but no creditcard or medical ...
- 1,591
37
votes
8
answers
13k
views
Why use random characters in passwords?
I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
- 497
38
votes
8
answers
7k
views
Are password complexity rules counterproductive?
In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember.
I was told that it did not meet complexity rules.
After several ...
- 491
30
votes
6
answers
7k
views
Is it insecure to display the number of characters when users enter a new passphrase?
When users are entering a new passphrase somewhere, it's helpful to provide feedback on the number of characters received by the system.
In a user experience (UX) test I just ran, my user created a ...
- 409
20
votes
4
answers
307k
views
Wordlists on Kali Linux?
I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?
- 383
30
votes
5
answers
5k
views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
- 1,672
19
votes
5
answers
8k
views
Someone is trying to access my mail account, what safe actions can I take?
Intro
I have a free mail account on this (german) website. If I type my password wrong I get, once successfully logged in, a message telling me about my failed log-in attempt.
Problem
Recently I ...
- 301
8
votes
5
answers
5k
views
Does it really improve a password if at least one character of each group (a-z,A-Z,0-9) is included? [duplicate]
Many password policies required at least one character of each group (upper case, lower case, symbols, and numbers) in the password.
Does this really improve a passwords strength?
e.g.: Is (number ...
- 191
11
votes
3
answers
7k
views
How to create dictionary to prevent weak passwords?
I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
- 213
7
votes
2
answers
6k
views
How many bits of entropy should a password have to be reasonably future proof (10+ years)?
I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
3
votes
3
answers
516
views
Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test
Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the ...
- 3,619
0
votes
4
answers
1k
views
Running SSH on a different port vs adding the port number to a password
So, a pretty typical piece of advice is to run SSH on a high port number, thus decreasing the chances of it being attacked. The thing I have always wondered about though is that it seems more secure ...
- 1,349
4
votes
3
answers
2k
views
Does mixing in keystrokes of Backspace, Arrows and Delete add any security to password typing?
It is well known that the analysis of the keyboard sound can reveal/hint at what keys were pressed when a password is typed.
One could mix in wrong characters (not belonging to the password) with ...
- 1,138