Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
0 votes
3 answers
155 views

Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

Is there any professional consensus on what the optimal password minimum length requirement should be? The University of Michigan recently implemented a 15 character minimum for all users. To me (...
user103496's user avatar
0 votes
2 answers
103 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
Broadways2's user avatar
25 votes
4 answers
6k views

Does a password policy with a restriction of repeated characters increase security?

A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
John Haire's user avatar
2 votes
0 answers
88 views

How is "partial" password reuse determined? [closed]

How do environments like Active Directory determine if you reuse parts of previous passwords in a new password? I understand that it keeps a list of your last passwords, hashed. But how do they ...
Sebastian S.'s user avatar
1 vote
1 answer
238 views

Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?

Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
KeyboardCat's user avatar
0 votes
1 answer
87 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
GROVER.'s user avatar
  • 101
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
Wulle's user avatar
  • 611
0 votes
2 answers
67 views

unencrypted user credentials accessible from the web app

I am testing a web app in which there is a section where it is possible to view all the users who can access it with their passwords in clear text. Is it normal this thing?
moskino11's user avatar
  • 117
30 votes
3 answers
7k views

Why are PIN codes usually of even length (4 or 6)?

A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
jonvyltra's user avatar
  • 409
0 votes
2 answers
182 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
Ninja64's user avatar
0 votes
0 answers
105 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
hongjun.choi's user avatar
2 votes
2 answers
128 views

How can I, as an enduser, put pressure on corporations and discourage password strength theater? [duplicate]

For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
Artimithe55's user avatar
0 votes
1 answer
275 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
Wrzlprmft's user avatar
  • 103
0 votes
0 answers
179 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user16551018's user avatar
0 votes
1 answer
2k views

strength of 64 character long password with containing only Hexadecimal digits (xdigit)

I wrote a small shell function to generate random passwords. Such a password may look like the below. D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1 I started to wonder if this is ...
The Fool's user avatar
  • 115
1 vote
1 answer
197 views

Password list where a password policy was used

I found a list of common passwords (i.e. "123456", "password", etc.) online. Is there a public / open-source set of common passwords where a password policy was in use? Example of ...
AleksanderCH's user avatar
-1 votes
1 answer
177 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
I Stand With Israel's user avatar
0 votes
1 answer
86 views

How to monitor your user accounts for breached logins?

On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password. This has ...
Cerin's user avatar
  • 101
0 votes
2 answers
315 views

Password Strength Determination

Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
JimmyHu's user avatar
  • 103
0 votes
1 answer
163 views

Is there data on the most common password strength requirements?

Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common: Password must contain a mix of upper and lower case ...
Lou's user avatar
  • 315
2 votes
2 answers
456 views

Passwords verification against a set of breached passwords

NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
user187205's user avatar
  • 1,283
0 votes
0 answers
39 views

What are the technical reasons not to use non-reversible transformation when encrypting password in database? [duplicate]

What are the technical reasons not to use non-reversible transformation when encrypting password in database? That way, even when password database is leaked, nobody can read any password. If it is ...
user avatar
0 votes
1 answer
154 views

The difficulty of securely storing a password

We have an open source software that allows users to be created. The users are saved in an LDAP directory. The software connects to the LDAP as an administrator to write a new entry for a new user, or ...
Matthias Ronge's user avatar
0 votes
0 answers
35 views

What characters should, and should I absolutely not use in generated passwords? [duplicate]

I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password. This has a lot of options, ...
TKTurbo's user avatar
3 votes
1 answer
804 views

How does Linux know if a new password is a "wrapped" version of a old one?

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password? Let's say I ...
William Martens's user avatar
23 votes
2 answers
4k views

Why do password requirements exist while limiting the upper character count? [duplicate]

I do not quite understand why it is common practice to require a difficult to remember password with alphanumeric and special character requirements, while also having an upper limit of 32 characters. ...
George Alfaro's user avatar
0 votes
2 answers
327 views

It is common for an account to be locked after X amount of failed logins, what are the best practice of selecting x?

To my understanding, it is common security practice to lock the account after X failed login attempts in N minute. Usually, the account will be locked for M minutes. I noticed that most of the time X ...
Ubaidah's user avatar
  • 1,074
7 votes
5 answers
652 views

Owner vs IT employee. Security and passwords

I own a company that has hired an IT employee. He has all passwords to servers, work stations and data. He is refusing to share or supply these passwords (Keys to the Kingdom) on the grounds of ...
Putz 's user avatar
  • 71
2 votes
1 answer
1k views

Why limit password length?

This question is inspired by Is there any security risk in not setting a maximum password length?. Specifically the accepted answer https://security.stackexchange.com/a/238033/9640 says limits are ...
emory's user avatar
  • 1,600
0 votes
1 answer
136 views

What happens if I reuse passwords

I want to understand the risk in reusing complex password. Unique complex passwords for each and every email account, say 3. All other accounts, bank, medical, social, share a complex password, 1 ...
paulj's user avatar
  • 157
25 votes
6 answers
8k views

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Context NIST SP 800-63b gives the following guidance for password forms (aka login pages): Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This ...
Mike Ounsworth's user avatar
0 votes
2 answers
143 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
RackAttack's user avatar
2 votes
0 answers
134 views

What is the right way to let user retrieve client secret in OAuth 2?

In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
ThunderSea's user avatar
2 votes
4 answers
387 views

Is password strength exclusively a function of character set size multiplied by password length-in-characters?

My team is responsible for the creation and management of many passwords (hundreds), which we do almost exclusively programmatically (all generation is random-enough). We leverage a variety of of ...
thump's user avatar
  • 21
2 votes
2 answers
127 views

Are there any known attacks (technical or social) against enterprises where password resets are scheduled on fixed (known) intervals?

A company I know of has a password policy that requires employees to change passwords (on AD server) every 90 days. The vast majority of its new hires start on the 1st of the month. Thus, several ...
Daniel Levin's user avatar
3 votes
1 answer
343 views

Security of bank account using a 8 digit password

Few months ago, my bank forced me to change my password. It was a random 32 characters long password, stored in a well-known password manager. The new password had to be exactly 8 digits, to be ...
aluriak's user avatar
  • 133
7 votes
5 answers
4k views

Specific character based policy for passwords

I'm wondering, would it be clearer to declare a company wide requirement with regard to password theoretical entropy, rather than the usual "at least one big letter, and a small latter, and special ...
Woodstock's user avatar
  • 689
7 votes
3 answers
308 views

Is it safe to share your password security plan with others?

The recent epidemic situation has given me enough time to reconsider my password security seriously. I have devised a detailed plan for how to use elements such as a password manager, 2FA, U2F keys, ...
dzejkob's user avatar
  • 323
1 vote
0 answers
132 views

Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain

Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
user3063785's user avatar
1 vote
2 answers
317 views

Is it better for me to bang on the keyboard for 12 characters or use my password manager's generator?

I use a password manager with a long rememberable master password for logging into all of my online accounts. When signing up for new accounts my password manager prompts me to generate a strong ...
Striar's user avatar
  • 113
12 votes
1 answer
4k views

Does SOC-2 compliance require password rotation

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) ...
Meir Maor's user avatar
  • 1,682
-1 votes
2 answers
197 views

Are password puzzles a thing?

Security policies have become like puzzles these days. Except for the obvious requirements like alpha-numberic, special symbols and length, there are more arbitrary rules. I've seen even 15 ...
Bor's user avatar
  • 293
1 vote
1 answer
130 views

Is it okay to log a user into multiple accounts when the email and password are the same?

We have a single web platform, where users can log in to different workspaces. Each workspace has its own list of users with email and password credentials and various permissions for each of those ...
qff's user avatar
  • 253
0 votes
1 answer
189 views

Is there any reason a password and pin combination isn't more popular?

So one of the problems with password is that users reuse them or use some weak password. For the latter, even enforcing pattern does not work as users will simply go for something like P@ssw0rd1 that ...
goriga6650's user avatar
0 votes
0 answers
100 views

Why would you restrict these characters within a password? [duplicate]

A website restricts these characters from passwords: # * ( ) % At a casual glance, it looks like they're not sanitizing data input to the database or hashing passwords, but I'm a hobbyist. Should I ...
Drew's user avatar
  • 401
-1 votes
1 answer
123 views

Password was required when buying the theater tickets

When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
Emil Brodt's user avatar
27 votes
8 answers
17k views

Are there joint password accounts? (Like bank accounts)

Online joint accounts that are similar to bank accounts that are joint accounts? Say you want to have two partners for a certain account, let's say a PayPal account, and you want to make it so that ...
larry909's user avatar
  • 635
3 votes
2 answers
851 views

Creating a Password Policy for a Bank Corporation, what must one take into consideration? [closed]

When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected? And how does this affect, employees, contractors, vendors, suppliers, and ...
John Smith's user avatar
4 votes
0 answers
200 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
Jon Bentley's user avatar
  • 2,001
9 votes
3 answers
2k views

Clearing password field after an invalid login attempt

From my experience, 99%[citation needed] of the time, when you try to log on to a website, and you mistype your password, you get some indication that the login could not proceed due to incorrect ...
zephyr's user avatar
  • 211

1
2 3 4 5
11