Skip to main content

Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
4 votes
1 answer
747 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
4 votes
1 answer
125 views

Is there a problem allowing two accounts to have the same recovery email?

It is a security problem to allow that two different user accounts have the same email address? If the answer is “no problem”, when the user goes to “forgot username” service, should I send an email ...
11 votes
5 answers
5k views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
35 votes
12 answers
27k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
0 votes
1 answer
215 views

Passwords/password hashes in plaintext in service configs - why is this common practice?

A while ago I wanted to deploy a service using a OCI (docker/podman) container, and I noticed to me, what seemed like a possibly distributing trend. In the build file for a lot of the containers, the ...
36 votes
5 answers
4k views

Are there any guidelines for passwords that need to be read out loud?

I recently saw the movie Olympus Has Fallen. Like in many action movies, at the end a missile is launched, and the hero (Mike Banning, played by Gerard Butler) has 60 seconds to recall the launch in ...
18 votes
2 answers
8k views

Are the SS64.com password generators a good approach?

There are two password generators on ss64.com: The standard one [Edit: now retired] The strong one How they work I made standalone versions of them, plus copy of the original HTML/Javascript ...
0 votes
2 answers
271 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
1 vote
5 answers
3k views

Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

Is there any professional consensus on what the optimal password minimum length requirement should be? The University of Michigan recently implemented a 15 character minimum for all users. To me (...
9 votes
2 answers
540 views

How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?

The DISA Application Developer STIG specifies: Group ID (Vulid): V-69565 Rule ID: SV-84187r1_rule Rule Version (STIG-ID): APSC-DV-001730 Rule Title: The application must require the change of at ...
102 votes
3 answers
20k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
108 votes
5 answers
39k views

How can waiting 24 hours to change the password again be secure?

So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password. Now, I wanted to change it to a more secure password but ...
70 votes
4 answers
10k views

Does Microsoft's "Password Ban" list insecurely store user passwords?

According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list: Microsoft says it is dynamically banning common passwords from Microsoft Account and ...
24 votes
4 answers
7k views

Does a password policy with a restriction of repeated characters increase security?

A security value called Restriction of Repeated Characters for Passwords (QPWDLMTREP) can be configured in IBM i. If QPWDLMTREP has a value of 1, then "the same character cannot be used more than ...
13 votes
4 answers
1k views

Reason to ban digits as first character in passwords? [closed]

When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far: At least 8 characters but no more than 13. Only usage of “valid” ...
11 votes
4 answers
1k views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
7 votes
1 answer
2k views

First X characters of your password cannot be identical to your previous one

The security policy at my employer has a password rotation policy for my workstation. Upon a recent change of password I immediately received an email telling me of an issue: According to our records,...
2 votes
0 answers
166 views

How is "partial" password reuse determined? [closed]

How do environments like Active Directory determine if you reuse parts of previous passwords in a new password? I understand that it keeps a list of your last passwords, hashed. But how do they ...
3 votes
3 answers
1k views

Is password dependent iteration count a good practice?

I consider the possibility of improving password security by increasing the hashing iteration count for short passwords. The security benefits I see of this practice are: Short passwords are better ...
97 votes
10 answers
32k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
4 votes
3 answers
450 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

Example strong diceware password: widow stout harvey crest zomba zloty butyl This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, ...
1 vote
1 answer
355 views

Password restrictions limit Diceware word list - (when) can this get bad enough one should choose another strategy?

Besides “your password must contain this” complexity requirements, some places also have “your password must not contain this” rules, sometimes with fairly short substrings of the username, a day of ...
0 votes
2 answers
310 views

Is it possible to design a system with two passwords?

Is it possible to design a system with two passwords prompts? The system will have to prompt for two passwords The system would have to validate first password before prompting for second password ...
0 votes
1 answer
205 views

My Bank Enforces A 6 Character Limit On Passwords. Is This Bad? [duplicate]

A bank I (previously) used in Australia forced users to comply with a 6-character limit on every password. Specifically, the rules were: 6 characters exactly, including at least 1 number and letter ...
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
2 votes
5 answers
3k views

What are the possible rules to identify password sharing- to prevent fraud

I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our ...
1 vote
1 answer
151 views

What are some well known websites that do not require multiple character sets in passwords? [closed]

NIST guidelines discourage password policies that require multiple character sets. Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or ...
1 vote
1 answer
186 views

Windows Fine-Grained Password Policies (FGPP) - Set Policy Duration

Trying to determine if there's a way to configure an FGPP(the policy itself) to last/be enforced only for a specified period of time or ideally, until a triggering event occurs. E.g., create temp ...
0 votes
2 answers
105 views

unencrypted user credentials accessible from the web app

I am testing a web app in which there is a section where it is possible to view all the users who can access it with their passwords in clear text. Is it normal this thing?
12 votes
4 answers
5k views

Requirement to send username and password in distinct email messages

I have an application that sends username and a password by email (random temporary password, mandatory change on first login). A big customer has this policy of "never send username and password in ...
137 votes
11 answers
83k views

Why not allow spaces in a password?

"Your password can't contain spaces." is a message I see from some websites, including 1 . Why? (This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
30 votes
3 answers
8k views

Why are PIN codes usually of even length (4 or 6)?

A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
25 votes
8 answers
31k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
11 votes
3 answers
7k views

How to create dictionary to prevent weak passwords?

I've been tasked with adding a "dictionary check" against user's passwords to prevent weak passwords. Unfortunately, that is about as much guidance as I've been given and I need some help deciphering ...
156 votes
17 answers
22k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
0 votes
0 answers
182 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
3 votes
2 answers
955 views

Creating a Password Policy for a Bank Corporation, what must one take into consideration? [closed]

When creating a Security Policy such as Password Policy, what are some of the typical assets that need to be protected? And how does this affect, employees, contractors, vendors, suppliers, and ...
2 votes
2 answers
171 views

How can I, as an enduser, put pressure on corporations and discourage password strength theater? [duplicate]

For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
0 votes
1 answer
584 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
186 votes
9 answers
26k views

Is the NHS wrong about passwords?

An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
0 votes
0 answers
253 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
74 votes
10 answers
51k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
0 votes
1 answer
597 views

Is using HOTP only authorization considered weak?

I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single Authorization, but it is also more inconvenient for a ...
33 votes
2 answers
10k views

What maximum password length to choose when using bcrypt?

When I generated password for GitHub with KeePass I got a message on GitHub site that said the limit for password length is 72 characters. It seemed weird it not being a power of 2 so I googled a bit ...
0 votes
1 answer
3k views

strength of 64 character long password with containing only Hexadecimal digits (xdigit)

I wrote a small shell function to generate random passwords. Such a password may look like the below. D2fdAbE5e9bcAFDBE5bEeED3b795ecf44B35e99B6D28591429fEE6B7C0BcCed1 I started to wonder if this is ...
1 vote
1 answer
329 views

Password list where a password policy was used

I found a list of common passwords (i.e. "123456", "password", etc.) online. Is there a public / open-source set of common passwords where a password policy was in use? Example of ...
2 votes
2 answers
3k views

Password-generating - which non-alphanumeric symbols can I use?

I'd like to make a password generator - strictly for myself. I'd like four "levels" of characters, but I'm a bit unsure of which symbols should be in each of the three latter ones - since I ...
-1 votes
1 answer
209 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
0 votes
1 answer
121 views

How to monitor your user accounts for breached logins?

On a few rare instances, I've received an email from a website notifying me that my email and password were found in batch of harvested logins, and they then force me to change my password. This has ...
0 votes
2 answers
530 views

Password Strength Determination

Recently, I've checked the some articles including R. E. Smith, The Strong Password Dilemma. ch. 6., Password Strength: An Empirical Analysis, Distance between two passwords and Password strength ...

1
2 3 4 5
11