Questions tagged [password-policy]
A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
504
questions
0
votes
5
answers
526
views
Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)
Is there any professional consensus on what the optimal password minimum length requirement should be?
The University of Michigan recently implemented a 15 character minimum for all users.
To me (...
- 101
0
votes
2
answers
168
views
Security of password managers vs. risk of losing access
Is it safe not to have a 2FA for a password manager itself?
It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
25
votes
4
answers
6k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
- 369
2
votes
0
answers
100
views
How is "partial" password reuse determined? [closed]
How do environments like Active Directory determine if you reuse parts of previous passwords in a new password? I understand that it keeps a list of your last passwords, hashed. But how do they ...
- 21
1
vote
1
answer
272
views
Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?
Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
- 235
0
votes
1
answer
119
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
- 101
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 611
0
votes
2
answers
72
views
unencrypted user credentials accessible from the web app
I am testing a web app in which there is a section where it is possible to view all the users who can access it with their passwords in clear text. Is it normal this thing?
- 117
30
votes
3
answers
7k
views
Why are PIN codes usually of even length (4 or 6)?
A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
- 409
0
votes
2
answers
210
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
- 1
0
votes
0
answers
120
views
Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)
I'm doing Red Hat (RHEL 6.5) security settings.
If I set up the two files as shown below, is there no security effect on each other?
/etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 ...
2
votes
2
answers
133
views
How can I, as an enduser, put pressure on corporations and discourage password strength theater? [duplicate]
For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
- 249
0
votes
1
answer
368
views
Is character restriction ever a safe mechanism against code injection / better than input sanitisation?
Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
- 103
0
votes
0
answers
198
views
Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?
I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
0
votes
1
answer
2k
views
strength of 64 character long password with containing only Hexadecimal digits (xdigit)
I wrote a small shell function to generate random passwords. Such a password may look like the below.
D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1
I started to wonder if this is ...
- 115
1
vote
1
answer
243
views
Password list where a password policy was used
I found a list of common passwords (i.e. "123456", "password", etc.) online.
Is there a public / open-source set of common passwords where a password policy was in use?
Example of ...
- 731
-1
votes
1
answer
183
views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
0
votes
1
answer
89
views
How to monitor your user accounts for breached logins?
On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password.
This has ...
- 101
0
votes
2
answers
374
views
Password Strength Determination
Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
- 103
0
votes
1
answer
203
views
Is there data on the most common password strength requirements?
Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common:
Password must contain a mix of upper and lower case ...
- 315
2
votes
2
answers
530
views
Passwords verification against a set of breached passwords
NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
- 1,293
0
votes
0
answers
39
views
What are the technical reasons not to use non-reversible transformation when encrypting password in database? [duplicate]
What are the technical reasons not to use non-reversible transformation when encrypting password in database? That way, even when password database is leaked, nobody can read any password. If it is ...
user255022
0
votes
1
answer
163
views
The difficulty of securely storing a password
We have an open source software that allows users to be created. The users are saved in an LDAP directory. The software connects to the LDAP as an administrator to write a new entry for a new user, or ...
- 123
0
votes
0
answers
35
views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
- 1
3
votes
1
answer
842
views
How does Linux know if a new password is a "wrapped" version of a old one?
How does Linux know if a new password is a "wrapped" version of an old password?
(or, the process of creating a new password) know "certain" parts of one's password?
Let's say I ...
- 177
23
votes
2
answers
4k
views
Why do password requirements exist while limiting the upper character count? [duplicate]
I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
- 357
0
votes
2
answers
679
views
It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?
To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes.
I noticed that most of the time X ...
- 1,074
7
votes
5
answers
795
views
Owner vs IT employee. Security and passwords
I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
- 71
2
votes
1
answer
1k
views
Why limit password length?
This question is inspired by Is there any security risk in not setting a maximum password length?.
Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
- 1,600
0
votes
1
answer
137
views
What happens if I reuse passwords
I want to understand the risk in reusing complex password.
Unique complex passwords for each and every email account, say 3.
All other accounts, bank, medical, social, share a complex password, 1
...
- 157
25
votes
6
answers
8k
views
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
Context
NIST SP 800-63b gives the following guidance for password forms (aka login pages):
Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
- 58.8k
0
votes
2
answers
144
views
Is it unsafe to have some users with passwords and some without?
I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
- 121
2
votes
0
answers
145
views
What is the right way to let user retrieve client secret in OAuth 2?
In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
- 23
2
votes
4
answers
404
views
Is password strength exclusively a function of character set size multiplied by password length-in-characters?
My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
- 21
2
votes
2
answers
128
views
Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?
A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
- 21
3
votes
1
answer
378
views
Security of bank account using a 8 digit password
Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager.
The new password had to be exactly 8 digits, to be ...
- 133
7
votes
5
answers
4k
views
Specific character based policy for passwords
I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
- 689
7
votes
3
answers
309
views
Is it safe to share your password security plan with others?
The recent epidemic situation has given me enough time to reconsider my password security seriously. I have devised a detailed plan for how to use elements such as a password manager, 2FA, U2F keys, ...
- 323
1
vote
0
answers
138
views
Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain
Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
- 21
1
vote
2
answers
330
views
Is it better for me to bang on the keyboard for 12 characters or use my password manager's generator?
I use a password manager with a long rememberable master password for logging into all of my online accounts. When signing up for new accounts my password manager prompts me to generate a strong ...
- 113
12
votes
1
answer
5k
views
Does SOC-2 compliance require password rotation
For convenience and security I find password rotation requirements harmful.
Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020?
I would think(hope) ...
- 1,682
-1
votes
2
answers
208
views
Are password puzzles a thing?
Security policies have become like puzzles these days.
Except for the obvious requirements like alpha-numberic, special symbols and
length, there are more arbitrary rules. I've seen even 15 ...
- 293
1
vote
1
answer
131
views
Is it okay to log a user into multiple accounts when the email and password are the same?
We have a single web platform, where users can log in to different workspaces.
Each workspace has its own list of users with email and password credentials and various permissions for each of those ...
- 253
0
votes
1
answer
192
views
Is there any reason a password and pin combination isn't more popular?
So one of the problems with password is that users reuse them or use some weak password. For the latter, even enforcing pattern does not work as users will simply go for something like P@ssw0rd1 that ...
0
votes
0
answers
102
views
Why would you restrict these characters within a password? [duplicate]
A website restricts these characters from passwords: # * ( ) %
At a casual glance, it looks like they're not sanitizing data input to the database or hashing passwords, but I'm a hobbyist.
Should I ...
- 401
-1
votes
1
answer
131
views
Password was required when buying the theater tickets
When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
27
votes
8
answers
18k
views
Are there joint password accounts? (Like bank accounts)
Online joint accounts that are similar to bank accounts that are joint accounts?
Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
- 635
3
votes
2
answers
893
views
Creating a Password Policy for a Bank Corporation, what must one take into consideration? [closed]
When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected?
And how does this affect, employees, contractors, vendors, suppliers, and ...
- 93
4
votes
0
answers
201
views
How to mitigate insecure password policy that I am forced to use?
The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
- 2,001
9
votes
3
answers
2k
views
Clearing password field after an invalid login attempt
From my experience, 99%[citation needed] of the time, when you try to log on to a website, and you mistype your password, you get some indication that the login could not proceed due to incorrect ...
- 211