A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

2
votes
0answers
115 views

Has password strength been an *actual* problem in a professional context? [closed]

Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the ...
130
votes
16answers
17k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
0
votes
1answer
77 views

How to manage all the unlock codes for thousands of mobile devices (iPads)?

I need to manage (assign, store, notify, etc.) the unlock code for thousands of mobile devices (iPads). How to manage optimally this unlock code? Maintenance users should be able to access the unlock ...
2
votes
2answers
138 views

Is this password inside a file secure? A security paradox

Preamble: I have been a long time lurker but first time poster to the Information Security site, so please be gentle with me. The Situation: I ran into a situation where I needed to securely store a ...
9
votes
7answers
2k views

How to securely counter users from adding a single digit to their old password upon creating a new one? [duplicate]

Let's say that in the password policy the password history is defined to remember the last 10 passwords. I understand password history exists so that if a password is recovered from a compromised ...
5
votes
1answer
86 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
1
vote
1answer
64 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
-1
votes
2answers
32 views

What could be a suitable solution to single factor authorization worksheet bank password circulation with no control?

Passwords for various banks are written in an excel sheet and this excel sheet is password protected. However, there is no control on circulation of this sheet, for many banks only single factor ...
12
votes
4answers
1k views

Does an *additional* company-wide password offer any real security?

So, let's say a company has what could be referred to as an "access key". Each user has their own username and password, and there is an additional company-wide access key that people must input with ...
1
vote
4answers
239 views

Complex password rules - is there any sense?

Let us assume that our system is well designed and it limits the amount of login errors so that brute force attach on the user interface is not possible. Say after 5 failed logins for an account the ...
2
votes
2answers
128 views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
3
votes
3answers
94 views

how is strength of password calculated from standard keyboard patterns?

In password strength calculator is there an algorithm to determine the keyboard pattern? there could be thousands if not millions of patterns that could be generated with a standard qwerty keyboard. ...
8
votes
4answers
108 views

Secure Memorable Passwords for Older Users

As with many people who work in IT I have found myself in the position of providing technical support for older relatives. Most of these relatives are not technically savvy and hate the idea of ...
0
votes
1answer
22 views

Active Directory password complexity based onto entropy

I am evaluating the possibility to enable password complexity rules into my Active Directory, but the rules it offers are for me not good. So I would like to have a complexity rule based onto only two ...
2
votes
2answers
66 views

Password generation based on hash of master password + suffix?

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
3
votes
4answers
167 views

Is it good practice to mandate input action on the password field in a webapp?

I am of the school of thought that says you should never have the browser "remember your password" because if you use it often enough, you will be able to retain that piece of information. I now want ...
3
votes
4answers
158 views

Password Policy: Issue random generated passwords / Let the user choose a password

I'm currently thinking about a new password policy. Originally I wanted the users to choose a password that is X digits long, contains numbers, special chars, lower and upper case,... but then I did ...
4
votes
3answers
96 views

How can I write a good corporate password policy?

Our company works in health care, and we've written a corporate security policy, including passwords. Something that I noticed about the policy and have commented on, it says the password should not ...
2
votes
2answers
81 views

Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future

Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is: # Generate a password and set it to $PASSWORD PASSWORD=$(tr ...
0
votes
2answers
142 views

How to check an open source product for password handling quality?

I just created an account on Magento Commerce, which is an online shop solution. During account creation, I entered a password. Personally I prefer longer, generated passwords that do not contain ...
1
vote
3answers
389 views

What would be a good set of criteria to consider a password safe? [duplicate]

Nowadays we see many websites with a "security meter" for the password. I actually think this is a great feature since it gives the final user the sense of how insecure their password could be. I ...
2
votes
4answers
247 views

If A Password Is Unique, Does It Really Matter How “Strong” It Is?

People seemed to find this "If a Password is Super-Strong Dose it Matter if It's Unique" question very interesting, but it actually reminded me that the converse one is interesting, too: If you use a ...
3
votes
3answers
126 views

Are there risks associated with a strong password reuse for disk encryption?

I understand the risks of password reuse when we share the password with 3rd parties as perfectly discussed under this question: Is password reuse a problem if the password is very strong? However I ...
59
votes
9answers
11k views

Is password reuse a problem if the password is very strong?

I always read that using the same password on multiple sites is a risk. I'm wondering what is the real reason for this? In my case, I use the same password on multiple sites everywhere. My password ...
2
votes
3answers
257 views

Is it possible to make cracking a password pointless to an attacker with database access?

I've been reading information on making passwords secure, but what are the reasons an attacker would want to put effort into getting the original password? If an attacker does indeed have a copy of ...
1
vote
0answers
70 views

Customized approach to protect plaintext passwords/usernames in database table?

I'm in the process of building an app to let users sign up, connect their many email accounts (like Gmail) to the site, and allow email-related activities... like sending an email (please don't ask or ...
82
votes
8answers
12k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
2
votes
3answers
453 views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
30
votes
6answers
5k views

What is the point of making a complicated PUBLIC password?

I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer. When running these images, a complete Windows environment is ...
4
votes
3answers
102 views

What is the argument for the fairly prevalent “No more than n repeating characters” password rule?

So, I understand why most commonly used password policies are used. N character minimum? No low hanging fruit left for brute force attacks. N character maximum? The database field can only be so ...
19
votes
4answers
5k views

Would allowing shorter passwords sometimes be more secure?

Does the act of requiring certain criteria for passwords make them easier to brute-force? It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier ...
1
vote
2answers
212 views

Website sent me my new password (after reset) in clear text [duplicate]

I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the ...
5
votes
1answer
86 views

Unique Touchscreen Authentication Schemes

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure. The initial thought process was to simply use a standard username ...
4
votes
1answer
114 views

Protecting SSH service with many inexperienced users

One of the universities I know has a rather unique password policy. They issue shell accounts to all computing students with strong passwords that are unchangeable. It is done via the passwd -n flag ...
0
votes
1answer
28 views

When do system access policies start to become source of security incidents? [closed]

Consider the assumption we are dealing with systems handling secret information which is crucial for an organization's existence. I would like to know what is a good balance between security ...
1
vote
2answers
169 views

Is there a way to securely store unsalted passwords?

So, obviously I'm not talking about username/password pairs here, I plan to store passwords with two salts and three hashes, but what occurred to me is that if I had a table where I kept pairs: ...
0
votes
2answers
63 views

Advantages of Enabling Firmware Password Protection

What security advantages, if any, would be gained by enabling Firmware Password Protection on a mac that allready has filevault encryption for the disk?
2
votes
1answer
65 views

How much should I change my 64 character TrueCrypt password?

I got a TrueCrypt container which is using a 64 character password. This password contains all the different kind of characters available to me (upper case, lower case, digits, special). It's taken ...
5
votes
3answers
298 views

Why do banks still hack-up autocomplete=off functionality?

With Bug #1025703 in the latest Firefox 38, Mozilla has finally decided to stand up for its users instead of catering to the banks that don't want the passwords remembered. However, I've noticed ...
11
votes
4answers
2k views

Why will Google no longer allow me to end or begin passwords with a space? [closed]

Why won't Google allow me to use a password ending in a space anymore? Backstory: I have memorized a cipher that allows me to generate a different and very strong password across many different ...
4
votes
5answers
267 views

How many combinations does a specific password policy allow?

Recently I was arguing about password policies. Assume you have a policy which requires 10 characters and additionally at least one letter, one number and one special character. My companion was ...
12
votes
7answers
2k views

Why don't we reward users who choose strong passwords? [closed]

Suppose there is a web property that has some sort of reward system or commodity that its users desire. It could be reputation on Stack Exchange-like sites, rank badges on message boards, or add-on ...
19
votes
3answers
2k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
1
vote
2answers
334 views

Do I need to set maximum characters length for password using bcrypt?

I using bcrypt to create a password hash and in the php documentation it says Caution: Using the PASSWORD_BCRYPT for the algo parameter, will result in the password parameter being truncated to ...
4
votes
2answers
439 views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
4
votes
1answer
80 views

Forgot Username/Email - Do extra credentials equal enough to log the user in?

I am working with another UX guy and he's let me know that there have been some studies surrounding the fact that when a person goes through a "forgot username/email" process, they enter in extra ...
27
votes
4answers
3k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
0
votes
2answers
100 views

Need some docs that say we shouldn't upper the string when saving it as a password [closed]

I'm trying to find on the Internet some manual, guide or policy secure about applications should not convert lower string to upper string to store as password I mean, don't make ...
2
votes
0answers
64 views

sample/starter code to test for TRUSTe password requirements [closed]

Considering its a requirement for Truste certification I figure that the code to test for a password meeting Truste's password strength requirements has been written more than a few times. I was ...