Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

1
vote
0answers
48 views

Disable Paste in Password field to use keystroke dynamics as 2FA

Paul Moore argues that one legitimate reason to disable paste in the password field (despite the downsides) is so that the server can use keystroke dynamics (behavioral biometrics) as a second form of ...
0
votes
1answer
53 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
50
votes
10answers
16k views

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
0
votes
0answers
33 views

Can we require a certain password policy of “external” OAuth providers?

I'm a security neophyte, so apologies if I'm not phrasing this correctly. If we design a system to allow connections to "external" OAuth providers (such as Azure AD), do we have any control over the ...
10
votes
1answer
1k views

Why don't Twitter and Facebook enforce password complexity during sign up? [closed]

If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however ...
0
votes
1answer
27 views

Should I back up automatic strong passwords of iCloud?

I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
0
votes
0answers
20 views

How can I much can I consider an email secure? [duplicate]

People always forgot passwords, so some people prefer to simply send a token over email https://hacks.mozilla.org/2014/10/passwordless-authentication-secure-simple-and-fast-to-deploy/ (which is the ...
0
votes
3answers
116 views

Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”

I am devising a set of password requirements. I am requiring users to use the following: Minimum 8 characters Minimum 1 number Minimum 1 special character Minimum 1 letter (any case) I would like ...
1
vote
1answer
79 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
1
vote
4answers
288 views

Dealing with users who reuse bad passwords

What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password? Scenario: A user wants to create an ...
0
votes
1answer
52 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
6
votes
3answers
302 views

Validate Japanese passwords

For English we have some good practice when we want to create an password, like Add numbers, symbols and capital letters. As result we have password like this: P@ssW0rd. Is there any rule like this ...
2
votes
1answer
67 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
64 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
5
votes
3answers
123 views

Doesn't persisting previous passwords pose a vulnerability?

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...
1
vote
1answer
166 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
0
votes
1answer
92 views

Reuse an email address with a leaked password

I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of ...
1
vote
3answers
116 views

What are reasons to ask for 2FA before password? [duplicate]

My employer's login flow asks for a username, then a 2fa, then a password. They do it this way because they fear someone could try to brute force passwords and create a denial of service attack by ...
1
vote
0answers
73 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
0
votes
2answers
155 views

Why do most ip camera manufacturers set an easy default password?

A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like admin, 1234, root ... The basic customer doesn't know that millions of ip ...
87
votes
12answers
24k views

IT will only give password over phone - but is that really more secure than email?

Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
2
votes
3answers
640 views

How to understand GitHub's password policy?

Today I tried to change my password on GitHub, but the site rejected my new password: The new password you provided has also been reported as compromised due to re-use of that password on another ...
2
votes
3answers
198 views

Does preventing password recycling increase or damage overall security?

The general opinion on password policies seems to be that complexity rules are counterproductive to security due to the human nature [1]. Does this also apply to password policies prohibiting the re-...
2
votes
2answers
166 views

Should Administrators regularly change their passwords

CESG state that users should not be forced to undergo regular password changes as it often harms, rather than improves security. Does this logic apply to administrators as well, such as domain admins? ...
0
votes
1answer
63 views

What are some well known websites that do not require multiple character sets in passwords?

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
7
votes
1answer
161 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
4
votes
3answers
388 views

What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks ...
35
votes
7answers
11k views

What are the security risks of logging the hash of rejected passwords?

According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...
7
votes
2answers
300 views

Is there value in changing your password after failed (malicious) login attempts?

I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...
-1
votes
2answers
166 views

Will password complexity requirements increase or decrease security given a haveibeenpwned check?

Given that you check that a password is not a common password and not present in a db with compromised passwords, will password complexity requirements (e.g. at least 1 lowercase and 1 uppercase ...
2
votes
2answers
1k views

How Often Should I Change my Passwords

I am using a password manager, and have optimized all my passwords so they are complex, long, and unique. I am wondering if there are any guidelines as to if I should still change my passwords from ...
3
votes
1answer
139 views

Forgot password best practice for mobile applications

There are known good practices for password reset functionality from OWASP and other resources. On the other hand, I believe most of us agree that security questions are not user friendly, they either ...
0
votes
0answers
45 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
-3
votes
1answer
96 views

Does bugzilla.mozilla.org's “new” password requirements make sense for that type of account/service?

I just tried to add some details to a bug I have reported at bugzilla.mozilla.org (BMO) but wasn't let in because my password had been nullified. Now they want me to create a new password meeting ...
49
votes
10answers
15k views

Confused about using a password that “would take centuries to break”

I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot. At work (finance company), I was ...
2
votes
4answers
158 views

Is it possible to send the user a randomly generated password while still storing it securely in the database?

NOTE: I am aware that many similar questions exist on the topic of storing passwords safely, however, I am posting this because I believe it is different enough from existing password storage ...
2
votes
1answer
71 views

recommendation to change encrypted-drive passphrases

There are numerous recommendations for how frequently to change users' passphrases, and I think the most recent NIST recommendation is "no minimum time to change passwords" (I might be mis-quoting). ...
31
votes
9answers
7k views

What considerations do I need to keep in mind when enforcing passphrases?

According to XKCD: Password Strength, if the password consists of “four random common words”, it will be secure and memorable. I want to make a web application and make users create their passwords ...
2
votes
1answer
862 views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum Password lenght requirements Second factor authentication Backup ...
7
votes
3answers
2k views

System prevents changing password too soon after previous change [duplicate]

Today when trying to change my voicemail pin, I noticed the system has a rule in place which prevents users from changing their voicemail pin too soon after the previous pin change. This was with a ...
1
vote
0answers
164 views

Should I use a random password for my technical user?

I am trying to find the smartest way to handle the root password in my product. For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
5
votes
6answers
756 views

Is a password really necessary? [closed]

For the purposes of security, is there any difference in having a 50 character randomly-generated secret username accompanied by a 50 character randomly-generated secret password, versus a 100 ...
0
votes
0answers
73 views

Admin asking for domain password: SOC-2 compliance issue?

We've already established elsewhere on this site that an admin asking for your password is not acceptable. Security concerns abound. S/he could impersonate you, or you could do something malicious and ...
2
votes
3answers
159 views

password complexity and policies from the users' point of view [duplicate]

There are two sides of password complexity, the administrator's side and the users' side. They are effectively disjointed requirements. Good complexity and policies of passwords are discussed often. ...
1
vote
2answers
405 views

How to securely send a password from one app to another app?

See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable? I am a Java developer that is building an app where ...
6
votes
1answer
2k views

Best practices for storing credentials used by code

Currently, I've many scripts that need to log in as superuser to automate many tasks. (For example, creating tables in databases, creating other users, etc.) Instead of having the credentials (...
0
votes
1answer
33 views

Relative Strength of Automated Password Suggestions

Some password management applications suggest strong passwords formed by groups of random words stringed together with a simple delimiter. For example: duplicate.aught.cavemen.length In contrast, I ...
1
vote
1answer
351 views

How to convert zxcvbn entropy to score

I want to use zxcvbn-c but it gives the entropy number, not score like the javascript library does. How do I convert entropy number to a score? (0 to 4) The zxcvbn blog/source mentions that the score ...
1
vote
1answer
103 views

How can I make a master policy file for Windows using Python?

A while ago I was asking questions about using python to secure windows. This was an answer I recieved. Could someone tell me how someone would do this? "As an overall way to do it, if you can find ...