Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

0
votes
1answer
110 views

Generating passwords with rule: the contents within a 10 characters string must maintain a certain ratio of numbers and letters in no particular order

I'm playing around with Kali and am looking to crack my WPA2 default password. I started generating 10 character passwords with a charset of solely digits and upper alpha lastnight and after 10 mins, ...
1
vote
1answer
72 views

Setting passwords for domain users, not expiring them, and not allowing them to be changed by users

We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this. Justification: The main reason is to ...
28
votes
2answers
4k views

Does password expiry provide any benefit at all (when using randomly generated passwords)?

I have been seeing a shift in password policy, this has been going on for a while (Article from 2017) but I have only just picked up on this. In my organization we expire the user passwords every 90 ...
0
votes
0answers
17 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
2answers
195 views

Is haveibeenpwned (HIBP) free and reliable? [closed]

I have just started to explore HIBP to check whether we can use HIBP in our public facing interfaces. AS per my read I have 3 options to check out. Download the password dictionary and implement my ...
1
vote
1answer
106 views

Are there any studies on the security of preventing password re-use in a single system? [duplicate]

Some system, when you change your password, they don't let you re-use previous passwords. For example, you use password 1, then change it to password 2, and then when you try to go back to password 1, ...
2
votes
2answers
138 views

Best practices for sharing or managing passwords between teams

Consider this scenario. A small company with several small teams (2-3 members). Each team manages their own passwords for their systems. Now, in the case when the whole team perishes in an accident, ...
0
votes
1answer
45 views

Secure Register - Login Portal [closed]

Im trying to create a secure portal for parents to view their sons or daughters information. I would need to have a register page. Im having trouble with hashing and salting the password. Then I ...
4
votes
3answers
191 views

What password policy should a typical web app have?

By "typical", I mean in terms of the value of the data and how hard attackers are likely to try to breach it, as opposed to one that's guarding data sensitive enough that it's worth significant ...
0
votes
1answer
42 views

Impact on required password entropy when introducing two-factor authentication [duplicate]

Is there a best practice or rule of thumb for the impact of introducting two-factor authentication on the required entropy of a used password? Say we consider 80 bits of entropy to be sufficient for ...
0
votes
2answers
148 views

Should a mobile banking app force clients to change their password periodically, e.g. every 3 months?

Is there an internet bank that forces users to change their passwords periodically? In Poland, none of the banks forces a change of the password for Internet banking. Of course, banks educate and ...
3
votes
2answers
189 views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
1
vote
5answers
175 views

Creating a unique password for each device

My team is currently working on an IoT product and we're having some issues thinking about a good way to create a unique password for each device. Each device runs on GNU/Linux and we have an ...
19
votes
6answers
8k views

Which password policy is more secure: one password of length 9 vs. two passwords each of length 8?

What is more secure, having one password of length 9 (salted and hashed) or having two different passwords, each of length 8 (salted and hashed using two different salts)?
1
vote
3answers
316 views

Question mark not allowed in password

Recently I came up with a password requirement rules as follows: The password must be 8-16 characters contain at least one number contain at least one lower case letter contain at least one upper ...
1
vote
2answers
124 views

Users can change their password with the same password

What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?
0
votes
0answers
33 views

Banks limiting complexity of passwords? [duplicate]

I was wondering why when I go to setup a bank account do they only let me use upper and lowercase characters and integers, with a limit in regards to the password length? As far as I'm aware the ...
4
votes
1answer
93 views

Can password strength be enforced with PAKE protocols?

Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number Be enforced if a PAKE protocol is used, ...
0
votes
1answer
90 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
67
votes
10answers
20k views

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
0
votes
1answer
108 views

Many websites allow passwords equal to username or e-mail address. Is this not a security risk?

I'm currently testing password policies on websites to get a feeling for what might be an acceptable policy/trade-off that provides good protection for our users without frustrating them. I was ...
3
votes
1answer
92 views

Is it a common practice to give a user an unmodifiable password?

I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in. Then I received an email ...
73
votes
8answers
14k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
1
vote
0answers
56 views

Disable Paste in Password field to use keystroke dynamics as 2FA

Paul Moore argues that one legitimate reason to disable paste in the password field (despite the downsides) is so that the server can use keystroke dynamics (behavioral biometrics) as a second form of ...
0
votes
1answer
90 views

Choose a sentence, a number, and the name as password [duplicate]

I would like to have your point of view about something I found on internet. The goal here is to help people to use stronger passwords, it's not perfect, but I believe that asking people to use ...
50
votes
10answers
16k views

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
10
votes
1answer
1k views

Why don't Twitter and Facebook enforce password complexity during sign up? [closed]

If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however ...
0
votes
2answers
70 views

Should I back up automatic strong passwords of iCloud?

I’ve recently started to use iCloud’s automatic strong passwords. I feel like that if iCloud were down for some reason, the passwords would be lost. Considering it, should I back them up on other ...
0
votes
3answers
128 views

Would it be more secure to enforce “at least one upper case” or to enforce “at least one letter (any case)”

I am devising a set of password requirements. I am requiring users to use the following: Minimum 8 characters Minimum 1 number Minimum 1 special character Minimum 1 letter (any case) I would like ...
1
vote
1answer
83 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
1
vote
4answers
407 views

Dealing with users who reuse bad passwords

What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password? Scenario: A user wants to create an ...
0
votes
1answer
95 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
6
votes
3answers
372 views

Validate Japanese passwords

For English we have some good practice when we want to create an password, like Add numbers, symbols and capital letters. As result we have password like this: P@ssW0rd. Is there any rule like this ...
2
votes
1answer
82 views

Is there any defense against this kind of attacks? (key comparison attack, or something)

is there any defense against this kind of attack? https://youtu.be/7U-RbOKanYs?t=974 I know someone who uses a password encryption hashing that generates the same length of keys as in this video and ...
1
vote
2answers
64 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
4
votes
3answers
133 views

Doesn't persisting previous passwords pose a vulnerability?

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...
1
vote
1answer
176 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
0
votes
1answer
97 views

Reuse an email address with a leaked password

I just found that the password of a very old email address was leaked. I did not use this email address for a long time cause I lost its password. But now that the password is out, I'm thinking of ...
1
vote
3answers
124 views

What are reasons to ask for 2FA before password? [duplicate]

My employer's login flow asks for a username, then a 2fa, then a password. They do it this way because they fear someone could try to brute force passwords and create a denial of service attack by ...
1
vote
0answers
81 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
0
votes
2answers
185 views

Why do most ip camera manufacturers set an easy default password?

A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like admin, 1234, root ... The basic customer doesn't know that millions of ip ...
87
votes
12answers
24k views

IT will only give password over phone - but is that really more secure than email?

Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
2
votes
3answers
1k views

How to understand GitHub's password policy?

Today I tried to change my password on GitHub, but the site rejected my new password: The new password you provided has also been reported as compromised due to re-use of that password on another ...
2
votes
3answers
206 views

Does preventing password recycling increase or damage overall security?

The general opinion on password policies seems to be that complexity rules are counterproductive to security due to the human nature [1]. Does this also apply to password policies prohibiting the re-...
2
votes
2answers
179 views

Should Administrators regularly change their passwords

CESG state that users should not be forced to undergo regular password changes as it often harms, rather than improves security. Does this logic apply to administrators as well, such as domain admins? ...
0
votes
1answer
64 views

What are some well known websites that do not require multiple character sets in passwords?

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
8
votes
2answers
252 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
4
votes
3answers
476 views

What is the real danger of not putting a login password in Windows in a small company except that of allowing anyone to go physicaly on your computer?

My question is simple. I work in a company of 10 employees where none of our computers have passwords to login into our Windows systems. The thing is my boss doesn't want passwords because he thinks ...
36
votes
7answers
12k views

What are the security risks of logging the hash of rejected passwords?

According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...
27
votes
10answers
5k views

How to strike a balance between security policies and practical implementation challenges? [duplicate]

At our organization, we came across some frequent incidents such as: Reported successful password guessing attacks Frequent password reset complaints We started an investigation to identify the ...