A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

learn more… | top users | synonyms

6
votes
2answers
463 views

What does “Change your password everywhere else” e-mail from compromised service mean?

I've recieved an e-mail from ubuntuforums.org a couple of hours ago: [...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum ...
4
votes
2answers
746 views

Would a massive blacklist of guessable passwords be useful? [duplicate]

Suggestions to make a good password all focus on creating a string that a computer (or more likely, a network of computers with multiple GPUs) can not guess. Putting a password meter for when users ...
30
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
2
votes
5answers
307 views

Is accepting old passwords a bad policy?

This question is inspired by an experience I had today with online banking, as follows. One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a ...
1
vote
1answer
1k views

Why do websites limit password length? [duplicate]

I just made a new account with some eGov service (Belgian government). I use LastPass (which generates long, random strings for each site), But the system told me that the maximum allowed length was ...
3
votes
0answers
246 views

Similar passwords can't be used again. A sign of unhashed password storage? [duplicate]

In my school everyone must change their password every six months. The new passwords cannot be the exact same as the old one, this make sense, however many of my peers often complain that they need ...
2
votes
2answers
141 views

What are the vulnerabilities of reusing passwords for generation of keys and encrypted files?

The main reason why reusing a password for different accounts is not recommended is that if the password is compromised, all accounts are compromised. This question is about vulnerabilities other ...
1
vote
6answers
3k views

Pronounceable Password Generator

I am currently looking for a password generator which produces pronounceable passwords. I have used this random password generator a few years ago to generate a 42 characters long password and found ...
23
votes
10answers
6k views

Intel How Strong is Your Password page, good advice?

I came across this Intel How Strong is Your Password? page which estimates how strong your password is. It has some advice on choosing better passwords including that you should use multiple ...
-3
votes
1answer
2k views

Good Password Length [duplicate]

If you are looking to be careful and your passwords include all the types of characters, what is the ideal password length?
1
vote
5answers
336 views

Should I enforce a password policy on a web site?

For a commercial web site, is it important to impose some restriction on passwords to access the system? Eg. special $char, Upper and lower case, numbers, at least a minimum length... Can a CAPTCHA ...
6
votes
3answers
358 views

Does prompting for security questions on new computers add any security on banking websites?

When you sign into Bank of America on a computer you haven't used with them before, the site prompts you to answer one of your security questions. How exactly does this make the site more secure? ...
1
vote
1answer
408 views

Why are Lengthy Password Stronger Than Complex? [duplicate]

So all my life I've been listening to people tell me to make complex password: Upper / Lower / Numeric / Symbols. Recently though I've been reading / seeing that length above all seems to make for ...
5
votes
2answers
1k views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their ...
1
vote
1answer
223 views

What rules should be enforced for users to create a strong password?

I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
1
vote
3answers
4k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
340
votes
12answers
56k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
77
votes
8answers
10k views

Why not allow spaces in a password?

"Your password can't contain spaces." is a message I see from some websites, including 1 . Why? (This question is very similar to Why Not Allow Special Characters In a Password? , but the answers ...
3
votes
2answers
165 views

What exactly is the impact on security when forcing user passwords to contain a particular character?

Some years ago a sysadmin of large computing centre (on a campus) enforced the password of every single user to contain the character $ at an arbitrary position. They soon dropped this policy but I ...
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
2
votes
3answers
394 views

Account lockout with human interaction required to unlock

I just got locked out yet again from my university's system for typing the wrong password twice, then mistyping the correct one by accident. Now I have to call the helpdesk or go there myself to reset ...
12
votes
3answers
469 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
3
votes
5answers
3k views

Password reset links: random value or authenticated message?

Which is better? Create tamper-proof encrypted password reset token which contains the user id and the expiration time within the encrypted token. Generate a random token and store it in the ...
3
votes
4answers
182 views

Generate DB Password from license key - a good idea?

There's this web app which has a SQLServer database, and the connection string it uses to access the database is not stored in any configuration file. Rather, the designers decided it would be a good ...
4
votes
4answers
640 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
8
votes
2answers
517 views

Banning specific passwords?

There have been a couple of questions about enforcing good passwords, so I thought I'd add my own: In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
5
votes
3answers
491 views

Use of rainbow tables with the NY Times hack?

The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military. One part of the story that ...
0
votes
2answers
2k views

Can my ISP know my passwords

If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
7
votes
3answers
596 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
3
votes
7answers
2k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
0
votes
3answers
2k views

Is it possible to change the wifi password with a script?

I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
0
votes
2answers
650 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
2
votes
3answers
361 views

Alternatives to Common Password Retrieval

Wired wrote an article recently about the top tech fails of 2012 and to no surprise, the password was on the list, more specifically the way a user can retrieve their passwords. What are some nifty ...
3
votes
8answers
536 views

Generate user a password instead of asking for one?

I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach? Workflow ...
3
votes
2answers
249 views

Doesn't adding requirements to a password, such as must contain 2 digits, decrease the strength? [duplicate]

Possible Duplicate: Doesn’t imposing a minimum password length make the password weaker by reducing the number of possible combinations? Doesn't any constraints added to a password policy ...
7
votes
5answers
583 views

Are we concentrating too much on password complexity?

As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
1answer
268 views

Is a One Time Password Scheme based on Diceware viable and secure?

I recently learned about diceware and was thinking about how it could possibly be used to create a one time password scheme. I'm thinking S/KEY is probably more appropriate, but would a system that ...
2
votes
3answers
264 views

At what point is password complexity “safe enough”

Obviously the best passwords will be highly complex randomly generated passwords stored in a password vault. For the average user though, this might be a slight overkill. Assuming that the average ...
3
votes
2answers
232 views

Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?

I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords? I personally have a list of a ...
8
votes
7answers
813 views

How can I prevent users from using bad passwords in my web application?

There is a long discussion on whether it's the responsibility of the user or the system administrator to deal with the strength of the password. Obviously, the password is a very private thing, but ...
3
votes
1answer
587 views

Updated list of bad/overused passwords [closed]

I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these Is there a place that constantly analyzes hacked websites ...
1
vote
2answers
561 views

Is dual control password is a feasible way to secure against unauthorized login?

I see that some organizations practice dual control password especially when it comes to critical system logins, etc. Is it feasible to implement such policy considering certain trade off such as ...
15
votes
4answers
1k views

My credit union is reducing its maximum password length to 10 characters

I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
26
votes
12answers
5k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
8
votes
11answers
2k views

How to easily remember lots of different passwords?

I know that you shouldn’t use the same password on every site. But, when you log into several dozen sites, keeping track of all the passwords can be pretty hard. What system do you recommend that ...
2
votes
6answers
1k views

Does Username + Password + Pin improve login security?

I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current ...
21
votes
6answers
3k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
3
votes
5answers
280 views

Is there any good (or less bad) way to handle a web portal or website with awful security?

Background: I'm facing a situation with an online site I must (for the immediate time being) use for financial and HR-related matters that just sucks. In every sense, but security in particular. As ...
11
votes
2answers
1k views

Requiring regular password change but storing previous paswords?

My bank requires me to change my password regularly but then they can detect if my password was used before. They probably store the old password (possibly hashed) in order to detect it. I think this ...
4
votes
2answers
299 views

How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”

First, this is not a homework problem. This is a problem from Matt Bishop's book "Introduction to Computer Security" which was used as one of the textbooks for a Computer Security class I took last ...