Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
0
votes
3answers
104 views

Password generator and password limitations

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password. My ideal are the sites that allow a good range of ...
1
vote
1answer
78 views

Is password generation adherent to a primitive pattern insecure?

A certain website I use has a section the password to which is e-mailed to you. I'm not involved with administrating it, but I've been able to discern the algorithm used for password creation. It uses ...
1
vote
1answer
103 views

Do non-administrator Windows accounts need strong passwords?

I have always used long passphrases for my own Windows user accounts. But I know some people who use moderately common passwords (we'll say they're in the top 1,000 most used passwords, but not in the ...
31
votes
12answers
12k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
4
votes
1answer
245 views

How were nuclear launch codes authenticated?

What is the history of authenticating nuclear launch codes? Were hashes used for verification? How would a nuclear launch base be able to verify that the code is correct, and how were new codes ...
2
votes
3answers
319 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
0
votes
1answer
119 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
79 views

Setting passwords for domain users, not expiring them, and not allowing them to be changed by users

We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this. Justification: The main reason is to ...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
0
votes
0answers
18 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
3
votes
2answers
278 views

Is haveibeenpwned (HIBP) free and reliable? [closed]

I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces. AS per my read I have 3 options to check out. Download the password dictionary and implement my ...
1
vote
1answer
107 views

Are there any studies on the security of preventing password re-use in a single system? [duplicate]

Some system, when you change your password, they don't let you re-use previous passwords. For example, you use password 1, then change it to password 2, and then when you try to go back to password 1, ...
3
votes
2answers
219 views

Best practices for sharing or managing passwords between teams

Consider this scenario. A small company with several small teams (2-3 members). Each team manages their own passwords for their systems. Now, in the case when the whole team perishes in an accident, ...
0
votes
1answer
46 views

Secure Register - Login Portal [closed]

Im trying to create a secure portal for parents to view their sons or daughters information. I would need to have a register page. Im having trouble with hashing and salting the password. Then I ...
4
votes
3answers
229 views

What password policy should a typical web app have?

By "typical", I mean in terms of the value of the data and how hard attackers are likely to try to breach it, as opposed to one that's guarding data sensitive enough that it's worth significant ...
0
votes
1answer
48 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
0
votes
2answers
154 views

Should a mobile banking app force clients to change their password periodically, e.g. every 3 months?

Is there an internet bank that forces users to change their passwords periodically? In Poland, none of the banks forces a change of the password for Internet banking. Of course, banks educate and ...
3
votes
2answers
197 views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
1
vote
5answers
211 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
19
votes
6answers
8k views

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
3answers
377 views

Question mark not allowed in password

Recently I came up with a password requirement rules as follows: The password must be 8-16 characters contain at least one number contain at least one lower case letter contain at least one upper ...
1
vote
2answers
145 views

Users can change their password with the same password

What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?
0
votes
0answers
37 views

Banks limiting complexity of passwords? [duplicate]

I was wondering why when I go to setup a bank account do they only let me use upper and lowercase characters and integers, with a limit in regards to the password length? As far as I'm aware the ...
5
votes
1answer
127 views

Can password strength be enforced with PAKE protocols?

Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number Be enforced if a PAKE protocol is used, ...
0
votes
1answer
107 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
68
votes
10answers
21k views

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
0
votes
1answer
115 views

Many websites allow passwords equal to username or e-mail address. Is this not a security risk?

I'm currently testing password policies on websites to get a feeling for what might be an acceptable policy/trade-off that provides good protection for our users without frustrating them. I was ...
3
votes
1answer
96 views

Is it a common practice to give a user an unmodifiable password?

I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in. Then I received an email ...
73
votes
8answers
15k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
1
vote
0answers
57 views

Disable Paste in Password field to use keystroke dynamics as 2FA

Paul Moore argues that one legitimate reason to disable paste in the password field (despite the downsides) is so that the server can use keystroke dynamics (behavioral biometrics) as a second form of ...
0
votes
1answer
121 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
50
votes
10answers
16k views

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
10
votes
1answer
1k views

Why don't Twitter and Facebook enforce password complexity during sign up? [closed]

If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however ...
0
votes
2answers
75 views

Should I back up automatic strong passwords of iCloud?

I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
0
votes
3answers
133 views

Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”

I am devising a set of password requirements. I am requiring users to use the following: Minimum 8 characters Minimum 1 number Minimum 1 special character Minimum 1 letter (any case) I would like ...
1
vote
1answer
83 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
1
vote
4answers
452 views

Dealing with users who reuse bad passwords

What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password? Scenario: A user wants to create an ...
0
votes
1answer
103 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
6
votes
3answers
432 views

Validate Japanese passwords

For English we have some good practice when we want to create an password, like Add numbers, symbols and capital letters. As result we have password like this: P@ssW0rd. Is there any rule like this ...
2
votes
1answer
89 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
64 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
4
votes
3answers
139 views

Doesn't persisting previous passwords pose a vulnerability?

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...
1
vote
1answer
180 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
0
votes
1answer
100 views

Reuse an email address with a leaked password

I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of ...
1
vote
3answers
133 views

What are reasons to ask for 2FA before password? [duplicate]

My employer's login flow asks for a username, then a 2fa, then a password. They do it this way because they fear someone could try to brute force passwords and create a denial of service attack by ...
1
vote
0answers
84 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
0
votes
2answers
197 views

Why do most ip camera manufacturers set an easy default password?

A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like admin, 1234, root ... The basic customer doesn't know that millions of ip ...
87
votes
12answers
24k views

IT will only give password over phone - but is that really more secure than email?

Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
2
votes
3answers
1k views

How to understand GitHub's password policy?

Today I tried to change my password on GitHub, but the site rejected my new password: The new password you provided has also been reported as compromised due to re-use of that password on another ...
3
votes
3answers
212 views

Does preventing password recycling increase or damage overall security?

The general opinion on password policies seems to be that complexity rules are counterproductive to security due to the human nature [1]. Does this also apply to password policies prohibiting the re-...