Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
0 votes
1 answer
81 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
user avatar
0 votes
0 answers
54 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
user avatar
2 votes
2 answers
108 views

How can I, as an enduser, put pressure on corporations and discourage password strength theater? [duplicate]

For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
user avatar
0 votes
1 answer
75 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
user avatar
  • 103
0 votes
0 answers
119 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user avatar
0 votes
1 answer
385 views

strength of 64 character long password with containing only Hexadecimal digits (xdigit)

I wrote a small shell function to generate random passwords. Such a password may look like the below. D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1 I started to wonder if this is ...
user avatar
  • 115
0 votes
1 answer
112 views

Password list where a password policy was used

I found a list of common passwords (i.e. "123456", "password", etc.) online. Is there a public / open-source set of common passwords where a password policy was in use? Example of ...
user avatar
-1 votes
1 answer
154 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
user avatar
0 votes
1 answer
80 views

How to monitor your user accounts for breached logins?

On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password. This has ...
user avatar
  • 101
0 votes
2 answers
199 views

Password Strength Determination

Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
user avatar
  • 103
0 votes
1 answer
129 views

Is there data on the most common password strength requirements?

Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common: Password must contain a mix of upper and lower case ...
user avatar
  • 315
1 vote
2 answers
211 views

Passwords verification against a set of breached passwords

NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
user avatar
  • 1,148
0 votes
0 answers
39 views

What are the technical reasons not to use non-reversible transformation when encrypting password in database? [duplicate]

What are the technical reasons not to use non-reversible transformation when encrypting password in database? That way, even when password database is leaked, nobody can read any password. If it is ...
user avatar
0 votes
1 answer
136 views

The difficulty of securely storing a password

We have an open source software that allows users to be created. The users are saved in an LDAP directory. The software connects to the LDAP as an administrator to write a new entry for a new user, or ...
user avatar
0 votes
0 answers
34 views

What characters should, and should I absolutely not use in generated passwords? [duplicate]

I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password. This has a lot of options, ...
user avatar
3 votes
1 answer
534 views

How does Linux know if a new password is a "wrapped" version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
user avatar
23 votes
2 answers
4k views

Why do password requirements exist while limiting the upper character count? [duplicate]

I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
user avatar
0 votes
2 answers
135 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
user avatar
  • 1,054
7 votes
5 answers
321 views

Owner vs IT employee. Security and passwords

I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
user avatar
  • 71
1 vote
1 answer
538 views

Why limit password length?

This question is inspired by Is there any security risk in not setting a maximum password length?. Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
user avatar
  • 1,560
0 votes
1 answer
125 views

What happens if I reuse passwords

I want to understand the risk in reusing complex password. Unique complex passwords for each and every email account, say 3. All other accounts, bank, medical, social, share a complex password, 1 ...
user avatar
  • 149
25 votes
6 answers
7k views

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Context NIST SP 800-63b gives the following guidance for password forms (aka login pages): Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
user avatar
0 votes
2 answers
135 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
user avatar
2 votes
0 answers
74 views

What is the right way to let user retrieve client secret in OAuth 2?

In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
user avatar
2 votes
4 answers
327 views

Is password strength exclusively a function of character set size multiplied by password length-in-characters?

My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
user avatar
  • 21
2 votes
2 answers
124 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
user avatar
3 votes
1 answer
225 views

Security of bank account using a 8 digit password

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager. The new password had to be exactly 8 digits, to be ...
user avatar
  • 133
7 votes
5 answers
4k views

Specific character based policy for passwords

I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
user avatar
  • 679
7 votes
3 answers
301 views

Is it safe to share your password security plan with others?

The recent epidemic situation has given me enough time to reconsider my password security seriously. I have devised a detailed plan for how to use elements such as a password manager, 2FA, U2F keys, ...
user avatar
  • 313
1 vote
0 answers
109 views

Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain

Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
user avatar
1 vote
2 answers
262 views

Is it better for me to bang on the keyboard for 12 characters or use my password manager's generator?

I use a password manager with a long rememberable master password for logging into all of my online accounts. When signing up for new accounts my password manager prompts me to generate a strong ...
user avatar
  • 113
11 votes
1 answer
3k views

Does SOC-2 compliance require password rotation

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) ...
user avatar
  • 1,632
-1 votes
2 answers
139 views

Are password puzzles a thing?

Security policies have become like puzzles these days. Except for the obvious requirements like alpha-numberic, special symbols and length, there are more arbitrary rules. I've seen even 15 ...
user avatar
  • 291
1 vote
1 answer
121 views

Is it okay to log a user into multiple accounts when the email and password are the same?

We have a single web platform, where users can log in to different workspaces. Each workspace has its own list of users with email and password credentials and various permissions for each of those ...
user avatar
  • 243
0 votes
1 answer
181 views

Is there any reason a password and pin combination isn't more popular?

So one of the problems with password is that users reuse them or use some weak password. For the latter, even enforcing pattern does not work as users will simply go for something like P@ssw0rd1 that ...
user avatar
0 votes
0 answers
92 views

Why would you restrict these characters within a password? [duplicate]

A website restricts these characters from passwords: # * ( ) % At a casual glance, it looks like they're not sanitizing data input to the database or hashing passwords, but I'm a hobbyist. Should I ...
user avatar
  • 401
-1 votes
1 answer
94 views

Password was required when buying the theater tickets

When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
user avatar
27 votes
8 answers
13k views

Are there joint password accounts? (Like bank accounts)

Online joint accounts that are similar to bank accounts that are joint accounts? Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
user avatar
  • 635
3 votes
2 answers
646 views

Creating a Password Policy for a Bank Corporation, what must one take into consideration? [closed]

When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected? And how does this affect, employees, contractors, vendors, suppliers, and ...
user avatar
4 votes
0 answers
179 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
user avatar
  • 2,001
8 votes
3 answers
1k views

Clearing password field after an invalid login attempt

From my experience, 99%[citation needed] of the time, when you try to log on to a website, and you mistype your password, you get some indication that the login could not proceed due to incorrect ...
user avatar
  • 201
2 votes
1 answer
257 views

How to check if a user's password has appeared in a breach?

The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden. What are some relatively straightforward steps that a ...
user avatar
  • 32.6k
2 votes
2 answers
668 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
user avatar
36 votes
8 answers
8k views

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if ...
user avatar
  • 2,391
3 votes
1 answer
251 views

Password seal by paper or by password manager?

At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method: The length of each password must be 16 characters, where they input ...
user avatar
  • 103
3 votes
1 answer
243 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
user avatar
  • 163
51 votes
5 answers
8k views

Why do many websites hide input when entering an OTP?

I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is. My understanding is that once an OTP is ...
user avatar
2 votes
2 answers
278 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
user avatar
  • 5,587
0 votes
1 answer
150 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
user avatar
  • 135
101 votes
3 answers
19k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
user avatar
  • 743

1
2 3 4 5
10