Skip to main content

Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
890 votes
14 answers
177k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
enderland's user avatar
  • 8,221
35 votes
4 answers
10k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
Hassan Saqib's user avatar
74 votes
10 answers
51k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
Gary's user avatar
  • 841
109 votes
7 answers
149k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
brentonstrine's user avatar
62 votes
12 answers
51k views

How long should the maximum password length be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
Mohamed's user avatar
  • 1,404
71 votes
9 answers
14k views

Is password reuse a problem if the password is very strong?

I always read that using the same password on multiple sites is a risk. I'm wondering what is the real reason for this? In my case, I use the same password on multiple sites everywhere. My password ...
chocolate's user avatar
  • 827
63 votes
5 answers
15k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
Drew Lex's user avatar
  • 2,023
156 votes
17 answers
22k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
TheJulyPlot's user avatar
  • 7,819
98 votes
13 answers
33k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
mika's user avatar
  • 963
34 votes
6 answers
13k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
ajax333221's user avatar
30 votes
4 answers
11k views

The registration confirmation email contains my password: do they keep it in plaintext?

I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
Alex's user avatar
  • 403
15 votes
3 answers
4k views

How often should passwords change?

I'm asking two very related questions As an admin what policies should be enforced regarding the frequency of password changing? I have an idea that users should be forced to change their password ...
Celeritas's user avatar
  • 10.2k
35 votes
12 answers
27k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
student's user avatar
  • 1,473
28 votes
3 answers
6k views

Should I have a maximum password length?

I'm creating a webapp, and part of my authentication method is password length. Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6). Are there ...
jrg's user avatar
  • 548
11 votes
5 answers
5k views

Best practice for forgot password form, ok to leak that a given e-mail is invalid

On our forgot password reset form, is it ok to leak that a given e-mail address entered is invalid? Or should we always just return success and check your e-mail, even if the e-mail is not valid. I ...
Justin's user avatar
  • 1,237
4 votes
2 answers
2k views

Password generation based on hash of master password + suffix? [duplicate]

Is this [1] a secure and reasonable way to generate a unique password for login on various websites? echo -n my_strong_master_password#website.com | sha1sum Of course, if my system is compromised ...
Simon's user avatar
  • 163
36 votes
2 answers
11k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
orange's user avatar
  • 483
20 votes
7 answers
3k views

Aren't password managers still incredibly risky?

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the ...
user49637's user avatar
  • 733
12 votes
2 answers
1k views

Is it a security risk to remind users of the password requirements at login?

I regularly find myself trying to login to websites where I don't remember the password I use. I make some guesses as to what I might have used but usually wind up having to reset it. One thing that ...
DHall's user avatar
  • 223
12 votes
3 answers
2k views

Banning specific passwords?

There have been a couple of questions about enforcing good passwords, so I thought I'd add my own: In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to ...
KeithS's user avatar
  • 6,778
11 votes
8 answers
6k views

Sequential password updates

Let's say I have a reasonable KDF, and that I make users change their passwords periodically and keep some old password hashes to prevent password reuse. What's to stop the user from changing the ...
Michael come lately's user avatar
10 votes
4 answers
1k views

Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?

I thought the strength of a password depended on the total number of possible combinations. Therefore, allowing longer passwords should be safer because you then have more possibilities. But why do ...
Shawn's user avatar
  • 201
5 votes
3 answers
2k views

Password strength metrics

In the question Source code as password I suggested using a combination of entropy and as @Lawtonfogle put it 'meatspace difficulty'. As suggested in the xkcd comic correct staple horse battery is a ...
COL Wotohice's user avatar
2 votes
2 answers
654 views

What is the evaluation criteria that a site uses for a password as strong , moderate or less secure

I have been in kind of jinx as to how a website decides on which password is highly vulnerable , strong etc . Lately my yahoo account was told to change password which I am using for long time as the ...
Yatin's user avatar
  • 123
233 votes
7 answers
48k views

Why would you not permit Q or Z in passwords?

Jetblue's password requirements specify that, among other stringent requirements: Cannot contain a Q or Z I can't fathom a logical reason for this, unless it were say, extremely common for the ...
Mark Mayo's user avatar
  • 1,913
50 votes
10 answers
17k views

Confused about using a password that "would take centuries to break"

I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot. At work (finance company), I was ...
Batman's user avatar
  • 835
38 votes
5 answers
24k views

New payment option on Paypal "Enter your online banking ID + password": Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like ...
Nicolas Raoul's user avatar
32 votes
7 answers
7k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
user389823's user avatar
27 votes
1 answer
43k views

Best practices for storing credentials used by code

Currently, I've many scripts that need to log in as superuser to automate many tasks. (For example, creating tables in databases, creating other users, etc.) Instead of having the credentials (...
sel's user avatar
  • 433
16 votes
3 answers
8k views

Is forcing users to change passwords useful?

In many places, there's a policy that force the user changing it's password once a few months. The logic here is, that even if the password have leaked somehow, it'll be abused only for a relatively ...
Elazar Leibovich's user avatar
14 votes
3 answers
2k views

An alternative to traditional passwords: is there some merit to this idea?

If you've got a website aimed at people that are not necessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
AardvarkSoup's user avatar
11 votes
4 answers
1k views

Why do salts for hashing passwords need to be globally unique, not just system/site-unique?

I was reading an answer by Terry Chia to another question about the requirements for a salt, in which he/she (among others) specified that salts need to be globally unique, but don't go into any ...
Char Star's user avatar
  • 113
10 votes
7 answers
8k views

Does having a minimum number of digits improve password security?

Some password systems will enforce at least X of a type of character - a common one I see is 'minimum 3 numeric characters'. As far as I understand, simply allowing certain character classes, like ...
Alex's user avatar
  • 505
7 votes
8 answers
2k views

Generate user a password instead of asking for one?

I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach? Workflow ...
AndrewX192's user avatar
7 votes
7 answers
13k views

Is it possible to detect password length from hash? Does doubling your password add more security?

Assuming a service doesn't store a plain text password, am I right in saying that the answer to this question depends on the service? On a bad service, the hash length is related to the password ...
superuser's user avatar
  • 1,151
4 votes
5 answers
806 views

Why should the *nix system administrator account (root) have a strong password if remote root logins are disabled?

It is a commonly accepted best security practice to disable remote root logins on *nix systems including Linux. Thus, in order to log in directly as root, you need to have physical access to a trusted ...
user's user avatar
  • 7,795
3 votes
3 answers
885 views

Account-lock security policy (username/password)

I am currently working on an application with regard to applying a security policy to the application. We are locking the account after X failed login attempts in Y minute. The account will be locked ...
user36009's user avatar
  • 163
2 votes
2 answers
3k views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized I'...
Fabio says Reinstate Monica's user avatar
1 vote
4 answers
595 views

Complex password rules - is there any sense?

Let us assume that our system is well designed and it limits the amount of login errors so that brute force attach on the user interface is not possible. Say after 5 failed logins for an account the ...
Tero Lahtinen's user avatar
107 votes
5 answers
38k views

How can waiting 24 hours to change the password again be secure?

So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password. Now, I wanted to change it to a more secure password but ...
ZN13's user avatar
  • 938
70 votes
4 answers
10k views

Does Microsoft's "Password Ban" list insecurely store user passwords?

According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list: Microsoft says it is dynamically banning common passwords from Microsoft Account and ...
Michael come lately's user avatar
65 votes
5 answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
Ben Sandeen's user avatar
40 votes
8 answers
7k views

Why do password strength requirements exist?

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
Bozho's user avatar
  • 1,223
36 votes
8 answers
8k views

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if ...
Michael come lately's user avatar
34 votes
6 answers
6k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
Chris Cirefice's user avatar
32 votes
12 answers
13k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
Vladimir's user avatar
  • 445
29 votes
4 answers
12k views

Is randomly generating passwords from an assortment of dictionary words cryptographically secure? [duplicate]

We should all know the XKCD comic on password strength, suggesting (appropriately) that a password based on multiple common words is more secure and memorable than a password such as Aw3s0m3s4u(3 or ...
Der Kommissar's user avatar
25 votes
6 answers
2k views

My credit union is reducing its maximum password length to 10 characters

I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 ...
devuxer's user avatar
  • 351
23 votes
3 answers
5k views

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...
MDMoore313's user avatar
15 votes
5 answers
8k views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
leomidu's user avatar
  • 151