Questions tagged [password-policy]
A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
15
questions with no upvoted or accepted answers
4
votes
0
answers
201
views
How to mitigate insecure password policy that I am forced to use?
The site in question is the UK regulator for companies at https://ewf.companieshouse.gov.uk. Online access to a company on this site enables the user to file/change various critical things on behalf ...
- 2,001
4
votes
1
answer
710
views
Developping an authentication system between client, server, and CouchDB database
I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
- 141
2
votes
0
answers
145
views
What is the right way to let user retrieve client secret in OAuth 2?
In the OAuth website here it says "Most services provide a way for developers to retrieve the secret of an existing application, although some will only display the secret one time and require ...
- 23
2
votes
0
answers
438
views
WPA2 EAP-TTLS with PAP: Does the authentication server know the password?
There's a wireless network that I sometimes need to connect to that uses WPA2 with EAP-TTLS and PAP as "inner" protocol.
I've been sent a certificate file (presumably for the TTLS to work) and given ...
- 196
1
vote
0
answers
138
views
Risks of choosing yes for remembering password for iPads, iPhones not having iCloud Keychain
Our mobile devices(iPhones, iPads) don't have iCloud Keychain which seems to have AES 256 bit encryption for storing credentials. The mobile browsers in those devices like Safari, Firefox, Chrome ask ...
- 21
1
vote
0
answers
179
views
Disable Paste in Password field to use keystroke dynamics as 2FA
Paul Moore argues that one legitimate reason to disable paste in the password field (despite the downsides) is so that the server can use keystroke dynamics (behavioral biometrics) as a second form of ...
- 2,100
1
vote
0
answers
135
views
Email login bug, is it a security concern for email users?
(The name is vague on purpose because I'm not entirely sure how bad of an issue this is or if it is well known yet and I don't want to accidentally leak some kind of major breach type thing)
Scenario:...
- 119
1
vote
0
answers
258
views
Should I use a random password for my technical user?
I am trying to find the smartest way to handle the root password in my product.
For legacy reasons, I need to have a technical account. My services create a token associated with this account ...
- 111
1
vote
0
answers
89
views
Making sure to type in the right password on the right place
This is not about technology, but about human factors.
I type in passwords so often, that it is a habit that doesn't require thinking. I type these fast and correct.
Lets take an SSH agent password ...
- 3,382
0
votes
0
answers
120
views
Red Hat Password Security Settings(/etc/pam.d/system-auth, /etc/login.defs)
I'm doing Red Hat (RHEL 6.5) security settings.
If I set up the two files as shown below, is there no security effect on each other?
/etc/pam.d/system-auth
password requisite pam_cracklib.so retry=3 ...
0
votes
0
answers
198
views
Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?
I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
0
votes
0
answers
93
views
Policy for regaining access to a colleague's account
I run a SaaS used by teams to collect company-related information (think something like Crashlytics). Even if the tool lets users invite their colleagues, we often find cases of individuals who ...
- 283
0
votes
0
answers
122
views
How to get a company to update their password policy
I frequently encounter questions about the reasons behind password policies and restrictions (Example1, Example2), the easiest example being the maximum length restrictions. The overwhelming ...
- 849
-1
votes
1
answer
131
views
Password was required when buying the theater tickets
When buying the theater tickets in the site biletru.co.il I was required for the email address and its password. Why ? If it is dangerous to enter the password in this case ?
-1
votes
1
answer
189
views
What is optimal way to connect accounts to 2FA on phone?
I have Google Acc 0 (GAO) mostly for bank porpoises and some "official" services. This email basically "[email protected]" and I put in my old C.V. and some other contact information.
When I got ...
