Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
7
votes
3answers
240 views

Is it safe to share your password security plan with others?

The recent epidemic situation has given me enough time to reconsider my password security seriously. I have devised a detailed plan for how to use elements such as a password manager, 2FA, U2F keys, ...
1
vote
0answers
27 views

Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain

Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
1
vote
2answers
121 views

Is it better for me to bang on the keyboard for 12 characters or use my password manager's generator?

I use a password manager with a long rememberable master password for logging into all of my online accounts. When signing up for new accounts my password manager prompts me to generate a strong ...
9
votes
1answer
1k views

Does SOC-2 compliance require password rotation

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) ...
-1
votes
2answers
86 views

Are password puzzles a thing?

Security policies have become like puzzles these days. Except for the obvious requirements like alpha-numberic, special symbols and length, there are more arbitrary rules. I've seen even 15 ...
1
vote
1answer
70 views

Is it okay to log a user into multiple accounts when the email and password are the same?

We have a single web platform, where users can log in to different workspaces. Each workspace has its own list of users with email and password credentials and various permissions for each of those ...
0
votes
0answers
68 views

Should I change my password if I googled it by mistake? [duplicate]

Related to this question, should I change my password if a password manager (keepass) mistakenly entered my user credentials in my search bar? What could happen if Google knows this? What about other ...
0
votes
1answer
128 views

Is there any reason a password and pin combination isn't more popular?

So one of the problems with password is that users reuse them or use some weak password. For the latter, even enforcing pattern does not work as users will simply go for something like P@ssw0rd1 that ...
0
votes
0answers
45 views

Why would you restrict these characters within a password? [duplicate]

A website restricts these characters from passwords: # * ( ) % At a casual glance, it looks like they're not sanitizing data input to the database or hashing passwords, but I'm a hobbyist. Should I ...
-1
votes
1answer
56 views

Password was required when buying the theater tickets

When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
27
votes
8answers
9k views

Are there joint password accounts? (Like bank accounts)

Online joint accounts that are similar to bank accounts that are joint accounts? Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
3
votes
2answers
265 views

Creating a Password Policy for a Bank Corporation, what must one take into consideration?

When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected? And how does this affect, employees, contractors, vendors, suppliers, and ...
4
votes
0answers
122 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
8
votes
3answers
838 views

Clearing password field after an invalid login attempt

From my experience, 99%[citation needed] of the time, when you try to log on to a website, and you mistype your password, you get some indication that the login could not proceed due to incorrect ...
2
votes
1answer
122 views

How to check if a user's password has appeared in a breach?

The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden. What are some relatively straightforward steps that a ...
2
votes
2answers
263 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
37
votes
8answers
8k views

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 ...
3
votes
1answer
113 views

Password seal by paper or by password manager?

At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method: The length of each password must be 16 characters, where they input ...
3
votes
1answer
133 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
0
votes
0answers
61 views

Learning how to audit a linux system, what does it mean to configure password & system auth?

I'm currently using Linux Red Hat OS, and I need to configure it accordingly to /etc/pam.d/password-auth and /etc/pam.d/system-auth under CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0-1. What page ...
48
votes
5answers
8k views

Why do many websites hide input when entering an OTP?

I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is. My understanding is that once an OTP is ...
2
votes
2answers
156 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
0
votes
1answer
63 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
101
votes
3answers
19k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
3answers
154 views

Password generator and password limitations

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password. My ideal are the sites that allow a good range of ...
1
vote
1answer
85 views

Is password generation adherent to a primitive pattern insecure?

A certain website I use has a section the password to which is e-mailed to you. I'm not involved with administrating it, but I've been able to discern the algorithm used for password creation. It uses ...
1
vote
1answer
165 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
31
votes
12answers
13k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
4
votes
1answer
255 views

How were nuclear launch codes authenticated?

What is the history of authenticating nuclear launch codes? Were hashes used for verification? How would a nuclear launch base be able to verify that the code is correct, and how were new codes ...
2
votes
3answers
341 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
0
votes
1answer
141 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
109 views

Setting passwords for domain users, not expiring them, and not allowing them to be changed by users

We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this. Justification: The main reason is to ...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
0
votes
0answers
19 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
3
votes
2answers
374 views

Is haveibeenpwned (HIBP) free and reliable? [closed]

I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces. AS per my read I have 3 options to check out. Download the password dictionary and implement my ...
1
vote
1answer
108 views

Are there any studies on the security of preventing password re-use in a single system? [duplicate]

Some system, when you change your password, they don't let you re-use previous passwords. For example, you use password 1, then change it to password 2, and then when you try to go back to password 1, ...
3
votes
2answers
498 views

Best practices for sharing or managing passwords between teams

Consider this scenario. A small company with several small teams (2-3 members). Each team manages their own passwords for their systems. Now, in the case when the whole team perishes in an accident, ...
0
votes
1answer
49 views

Secure Register - Login Portal [closed]

Im trying to create a secure portal for parents to view their sons or daughters information. I would need to have a register page. Im having trouble with hashing and salting the password. Then I ...
5
votes
3answers
528 views

What password policy should a typical web app have?

By "typical", I mean in terms of the value of the data and how hard attackers are likely to try to breach it, as opposed to one that's guarding data sensitive enough that it's worth significant ...
0
votes
1answer
72 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
0
votes
2answers
172 views

Should a mobile banking app force clients to change their password periodically, e.g. every 3 months?

Is there an internet bank that forces users to change their passwords periodically? In Poland, none of the banks forces a change of the password for Internet banking. Of course, banks educate and ...
3
votes
2answers
287 views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
1
vote
5answers
449 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
19
votes
6answers
8k views

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
3answers
709 views

Question mark not allowed in password

Recently I came up with a password requirement rules as follows: The password must be 8-16 characters contain at least one number contain at least one lower case letter contain at least one upper ...
1
vote
2answers
250 views

Users can change their password with the same password

What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?
6
votes
1answer
212 views

Can password strength be enforced with PAKE protocols?

Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number Be enforced if a PAKE protocol is used, ...
0
votes
1answer
132 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
67
votes
10answers
22k views

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
0
votes
1answer
150 views

Many websites allow passwords equal to username or e-mail address. Is this not a security risk?

I'm currently testing password policies on websites to get a feeling for what might be an acceptable policy/trade-off that provides good protection for our users without frustrating them. I was ...

1
2 3 4 5
10