Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login/defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
2
votes
2answers
98 views

How can I, as an enduser, put pressure on corporations and discourage password strength theater? [duplicate]

For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
0
votes
1answer
57 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
0
votes
0answers
97 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
0
votes
1answer
231 views

strength of 64 character long password with containing only Hexadecimal digits (xdigit)

I wrote a small shell function to generate random passwords. Such a password may look like the below. D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1 I started to wonder if this is ...
0
votes
1answer
101 views

Password list where a password policy was used

I found a list of common passwords (i.e. "123456", "password", etc.) online. Is there a public / open-source set of common passwords where a password policy was in use? Example of ...
-1
votes
1answer
143 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
0
votes
1answer
72 views

How to monitor your user accounts for breached logins?

On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password. This has ...
0
votes
2answers
179 views

Password Strength Determination

Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
0
votes
1answer
114 views

Is there data on the most common password strength requirements?

Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common: Password must contain a mix of upper and lower case ...
1
vote
2answers
174 views

Passwords verification against a set of breached passwords

NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
0
votes
0answers
39 views

What are the technical reasons not to use non-reversible transformation when encrypting password in database? [duplicate]

What are the technical reasons not to use non-reversible transformation when encrypting password in database? That way, even when password database is leaked, nobody can read any password. If it is ...
0
votes
1answer
122 views

The difficulty of securely storing a password

We have an open source software that allows users to be created. The users are saved in an LDAP directory. The software connects to the LDAP as an administrator to write a new entry for a new user, or ...
0
votes
0answers
33 views

What characters should, and should I absolutely not use in generated passwords? [duplicate]

I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password. This has a lot of options, ...
3
votes
1answer
457 views

How does Linux know if a new password is a "wrapped" version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
23
votes
2answers
3k views

Why do password requirements exist while limiting the upper character count? [duplicate]

I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
0
votes
2answers
113 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
7
votes
5answers
290 views

Owner vs IT employee. Security and passwords

I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
1
vote
1answer
412 views

Why limit password length?

This question is inspired by Is there any security risk in not setting a maximum password length?. Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
0
votes
1answer
117 views

What happens if I reuse passwords

I want to understand the risk in reusing complex password. Unique complex passwords for each and every email account, say 3. All other accounts, bank, medical, social, share a complex password, 1 ...
25
votes
6answers
7k views

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Context NIST SP 800-63b gives the following guidance for password forms (aka login pages): Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
0
votes
2answers
124 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
2
votes
0answers
64 views

What is the right way to let user retrieve client secret in OAuth 2?

In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
2
votes
4answers
307 views

Is password strength exclusively a function of character set size multiplied by password length-in-characters?

My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
2
votes
2answers
116 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
3
votes
1answer
188 views

Security of bank account using a 8 digit password

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager. The new password had to be exactly 8 digits, to be ...
7
votes
5answers
4k views

Specific character based policy for passwords

I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
7
votes
3answers
292 views

Is it safe to share your password security plan with others?

The recent epidemic situation has given me enough time to reconsider my password security seriously. I have devised a detailed plan for how to use elements such as a password manager, 2FA, U2F keys, ...
1
vote
0answers
93 views

Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain

Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
1
vote
2answers
233 views

Is it better for me to bang on the keyboard for 12 characters or use my password manager's generator?

I use a password manager with a long rememberable master password for logging into all of my online accounts. When signing up for new accounts my password manager prompts me to generate a strong ...
10
votes
1answer
3k views

Does SOC-2 compliance require password rotation

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) ...
-1
votes
2answers
126 views

Are password puzzles a thing?

Security policies have become like puzzles these days. Except for the obvious requirements like alpha-numberic, special symbols and length, there are more arbitrary rules. I've seen even 15 ...
1
vote
1answer
112 views

Is it okay to log a user into multiple accounts when the email and password are the same?

We have a single web platform, where users can log in to different workspaces. Each workspace has its own list of users with email and password credentials and various permissions for each of those ...
0
votes
1answer
169 views

Is there any reason a password and pin combination isn't more popular?

So one of the problems with password is that users reuse them or use some weak password. For the latter, even enforcing pattern does not work as users will simply go for something like P@ssw0rd1 that ...
0
votes
0answers
80 views

Why would you restrict these characters within a password? [duplicate]

A website restricts these characters from passwords: # * ( ) % At a casual glance, it looks like they're not sanitizing data input to the database or hashing passwords, but I'm a hobbyist. Should I ...
-1
votes
1answer
86 views

Password was required when buying the theater tickets

When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
27
votes
8answers
12k views

Are there joint password accounts? (Like bank accounts)

Online joint accounts that are similar to bank accounts that are joint accounts? Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
3
votes
2answers
568 views

Creating a Password Policy for a Bank Corporation, what must one take into consideration? [closed]

When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected? And how does this affect, employees, contractors, vendors, suppliers, and ...
4
votes
0answers
165 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
8
votes
3answers
1k views

Clearing password field after an invalid login attempt

From my experience, 99%[citation needed] of the time, when you try to log on to a website, and you mistype your password, you get some indication that the login could not proceed due to incorrect ...
2
votes
1answer
213 views

How to check if a user's password has appeared in a breach?

The latest advice (e.g. from NIST) recommends that user's password are checked against known breaches and compromised passwords are forbidden. What are some relatively straightforward steps that a ...
2
votes
2answers
588 views

How often, if at all, should I rotate my passwords?

In the course of my computer working I daily use dozens of username/passphrase pairs. Within the limits of my understanding and restrictions I apply the best practices for security. Unfortunately I ...
36
votes
8answers
8k views

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if ...
3
votes
1answer
211 views

Password seal by paper or by password manager?

At my current company, the IT Risk team decided to ensure root passwords of about 90 systems by the following conventional method: The length of each password must be 16 characters, where they input ...
3
votes
1answer
222 views

Can having certain restrictions/rules make passcodes less secure?

Say I have a phone whose security is corporately managed, and this management demands that I use a 6 digit passcode to lock the phone. So far, so reasonable. This gives an attacker a possibility of 1,...
51
votes
5answers
8k views

Why do many websites hide input when entering an OTP?

I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is. My understanding is that once an OTP is ...
2
votes
2answers
251 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
0
votes
1answer
140 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
101
votes
3answers
19k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
0
votes
3answers
335 views

Password generator and password limitations

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password. My ideal are the sites that allow a good range of ...

1
2 3 4 5
10