Questions tagged [password-policy]
A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
504
questions
0
votes
2
answers
168
views
Security of password managers vs. risk of losing access
Is it safe not to have a 2FA for a password manager itself?
It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
0
votes
5
answers
526
views
Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)
Is there any professional consensus on what the optimal password minimum length requirement should be?
The University of Michigan recently implemented a 15 character minimum for all users.
To me (...
- 71
4
votes
1
answer
710
views
Developping an authentication system between client, server, and CouchDB database
I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
CommunityBot
- 1
9
votes
2
answers
482
views
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at ...
- 241
102
votes
3
answers
20k
views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
- 947
108
votes
5
answers
36k
views
How can waiting 24 hours to change the password again be secure?
So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password.
Now, I wanted to change it to a more secure password but ...
- 1
70
votes
4
answers
10k
views
Does Microsoft's "Password Ban" list insecurely store user passwords?
According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list:
Microsoft says it is dynamically banning common passwords from Microsoft Account and ...
25
votes
4
answers
6k
views
Does a password policy with a restriction of repeated characters increase security?
A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
13
votes
4
answers
1k
views
Reason to ban digits as first character in passwords? [closed]
When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far:
At least 8 characters but no more than 13.
Only usage of “valid” ...
- 101
11
votes
4
answers
972
views
Why do salts for hashing passwords need to be globally unique, not just system/site-unique?
I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
- 2,125
7
votes
1
answer
2k
views
First X characters of your password cannot be identical to your previous one
The security policy at my employer has a password rotation policy for my workstation. Upon a recent change of password I immediately received an email telling me of an issue:
According to our records,...
- 1
2
votes
0
answers
100
views
How is "partial" password reuse determined? [closed]
How do environments like Active Directory determine if you reuse parts of previous passwords in a new password? I understand that it keeps a list of your last passwords, hashed. But how do they ...
- 199k
3
votes
3
answers
981
views
Is password dependent iteration count a good practice?
I consider the possibility of improving password security by increasing the hashing iteration count for short passwords.
The security benefits I see of this practice are:
Short passwords are better ...
- 185
98
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 928
4
votes
3
answers
405
views
Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?
Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
- 18.8k
1
vote
1
answer
272
views
Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?
Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
- 12.2k
0
votes
2
answers
210
views
Is it possible to design a system with two passwords?
Is it possible to design a system with two passwords prompts?
The system will have to prompt for two passwords
The system would have to validate first password before prompting for second password
...
0
votes
1
answer
119
views
My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]
A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were:
6 characters exactly, including at least 1 number and letter
...
CommunityBot
- 1
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 105
2
votes
5
answers
3k
views
What are the possible rules to identify password sharing- to prevent fraud
I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
- 11
1
vote
1
answer
129
views
What are some well known websites that do not require multiple character sets in passwords? [closed]
NIST guidelines discourage password policies that require multiple character sets.
Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
- 335
1
vote
1
answer
163
views
Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration
Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
CommunityBot
- 1
0
votes
2
answers
72
views
unencrypted user credentials accessible from the web app
I am testing a web app in which there is a section where it is possible to view all the users who can access it with their passwords in clear text. Is it normal this thing?
- 46.4k
12
votes
4
answers
5k
views
Requirement to send username and password in distinct email messages
I have an application that sends username and a password by email (random temporary password, mandatory change on first login).
A big customer has this policy of "never send username and password in ...
- 1,187
137
votes
11
answers
80k
views
Why not allow spaces in a password?
"Your password can't contain spaces."
is a message I see from some websites,
including 1 .
Why?
(This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
- 128k
30
votes
3
answers
7k
views
Why are PIN codes usually of even length (4 or 6)?
A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
- 11k
25
votes
8
answers
28k
views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
11
votes
3
answers
7k
views
How to create dictionary to prevent weak passwords?
I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
157
votes
17
answers
22k
views
Is the BBC’s advice on choosing a password sensible?
In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.
Step 1: Choose an artist (a recording artist I presume)
Lets choose as an example ...
- 2,265
0
votes
0
answers
120
views
Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)
I'm doing Red Hat (RHEL 6.5) security settings.
If I set up the two files as shown below, is there no security effect on each other?
/etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 ...
3
votes
2
answers
893
views
Creating a Password Policy for a Bank Corporation, what must one take into consideration? [closed]
When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected?
And how does this affect, employees, contractors, vendors, suppliers, and ...
- 128k
2
votes
2
answers
133
views
How can I, as an enduser, put pressure on corporations and discourage password strength theater? [duplicate]
For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
- 128k
0
votes
1
answer
368
views
Is character restriction ever a safe mechanism against code injection / better than input sanitisation?
Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
- 199k
186
votes
9
answers
26k
views
Is the NHS wrong about passwords?
An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
- 2,125
0
votes
0
answers
198
views
Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?
I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
- 22.7k
75
votes
10
answers
50k
views
Why Disallow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
- 113
0
votes
1
answer
540
views
Is using HOTP only authorization considered weak?
I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes.
I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for a ...
- 128k
32
votes
2
answers
10k
views
What maximum password length to choose when using bcrypt?
When I generated password for GitHub with KeePass I got a message on GitHub site that said the limit for password length is 72 characters. It seemed weird it not being a power of 2 so I googled a bit ...
- 8,416
0
votes
1
answer
2k
views
strength of 64 character long password with containing only Hexadecimal digits (xdigit)
I wrote a small shell function to generate random passwords. Such a password may look like the below.
D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1
I started to wonder if this is ...
- 10.5k
1
vote
1
answer
244
views
Password list where a password policy was used
I found a list of common passwords (i.e. "123456", "password", etc.) online.
Is there a public / open-source set of common passwords where a password policy was in use?
Example of ...
- 11k
2
votes
2
answers
3k
views
Password-generating - which non-alphanumeric symbols can I use?
I'd like to make a password generator - strictly for myself. I'd like four "levels" of characters, but I'm a bit unsure of which symbols should be in each of the three latter ones - since I ...
- 128k
-1
votes
1
answer
183
views
What are the security implications of the password policy for this bank? [duplicate]
I am aware of a bank (redacted for obvious reasons) that has the following password policy.
Only English alphanumeric characters
Min of 8, max of 14 characters
No special characters (ex. !@#$%^&* ...
- 128k
0
votes
1
answer
89
views
How to monitor your user accounts for breached logins?
On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password.
This has ...
- 128k
0
votes
2
answers
374
views
Password Strength Determination
Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...
- 18.8k
0
votes
1
answer
203
views
Is there data on the most common password strength requirements?
Many websites have different requirements for a strong password (beyond simple length I mean). Anecdotally, I think these requirements are common:
Password must contain a mix of upper and lower case ...
- 128k
2
votes
2
answers
530
views
Passwords verification against a set of breached passwords
NIST and OWASP ASVS recommends checking passwords against those obtained from previous data breaches. The list of such passwords can be downloaded from "Have I Been Pwned" (https://...
CommunityBot
- 1
3
votes
1
answer
842
views
How does Linux know if a new password is a "wrapped" version of a old one?
How does Linux know if a new password is a "wrapped" version of an old password?
(or, the process of creating a new password) know "certain" parts of one's password?
Let's say I ...
- 177
0
votes
0
answers
39
views
What are the technical reasons not to use non-reversible transformation when encrypting password in database? [duplicate]
What are the technical reasons not to use non-reversible transformation when encrypting password in database? That way, even when password database is leaked, nobody can read any password. If it is ...
CommunityBot
- 1
0
votes
1
answer
163
views
The difficulty of securely storing a password
We have an open source software that allows users to be created. The users are saved in an LDAP directory. The software connects to the LDAP as an administrator to write a new entry for a new user, or ...
- 46.4k
0
votes
0
answers
35
views
What characters should, and should I absolutely not use in generated passwords? [duplicate]
I'm currently setting up a KeePass database after switching over from another password manager, and it has the option to change the character set for generating a password.
This has a lot of options, ...
- 1