Skip to main content

Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

15 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
228 views

How to mitigate insecure password policy that I am forced to use?

The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
Jon Bentley's user avatar
  • 2,061
4 votes
1 answer
747 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
Vinz243's user avatar
  • 141
2 votes
0 answers
184 views

What is the right way to let user retrieve client secret in OAuth 2?

In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
ThunderSea's user avatar
2 votes
0 answers
463 views

WPA2 EAP-TTLS with PAP: Does the authentication server know the password?

There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol. I've been sent a certificate file (presumably for the TTLS to work) and given ...
Daniel Jour's user avatar
1 vote
0 answers
169 views

Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain

Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
user3063785's user avatar
1 vote
0 answers
211 views

Disable Paste in Password field to use keystroke dynamics as 2FA

Paul Moore argues that one legitimate reason to disable paste in the password field (despite the downsides) is so that the server can use keystroke dynamics (behavioral biometrics) as a second form of ...
browly's user avatar
  • 2,110
1 vote
0 answers
158 views

Email login bug, is it a security concern for email users?

(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing) Scenario:...
user64742's user avatar
  • 119
1 vote
0 answers
280 views

Should I use a random password for my technical user?

I am trying to find the smartest way to handle the root password in my product. For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
cadesalaberry's user avatar
1 vote
0 answers
110 views

Making sure to type in the right password on the right place

This is not about technology, but about human factors. I type in passwords so often, that it is a habit that doesn't require thinking. I type these fast and correct. Lets take an SSH agent password ...
allo's user avatar
  • 3,451
0 votes
0 answers
182 views

Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)

I'm doing Red Hat (RHEL 6.5) security settings. If I set up the two files as shown below, is there no security effect on each other? /etc/pam.d/system-auth password requisite pam_cracklib.so retry=3 ...
hongjun.choi's user avatar
0 votes
0 answers
253 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user16551018's user avatar
0 votes
0 answers
115 views

Policy for regaining access to a colleague's account

I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
gimix's user avatar
  • 283
0 votes
0 answers
144 views

How to get a company to update their password policy

I frequently encounter questions about the reasons behind password policies and restrictions (Example1, Example2), the easiest example being the maximum length restrictions. The overwhelming ...
elmer007's user avatar
  • 849
-1 votes
1 answer
178 views

Password was required when buying the theater tickets

When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
Emil Brodt's user avatar
-1 votes
1 answer
211 views

What is optimal way to connect accounts to 2FA on phone?

I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "[email protected]" and I put in my old C.V. and some other contact information. When I got ...
greyd.omh's user avatar