Skip to main content

Questions tagged [password-policy]

A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.

Filter by
Sorted by
Tagged with
891 votes
14 answers
177k views

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
enderland's user avatar
  • 8,231
234 votes
7 answers
48k views

Why would you not permit Q or Z in passwords?

Jetblue's password requirements specify that, among other stringent requirements: Cannot contain a Q or Z I can't fathom a logical reason for this, unless it were say, extremely common for the ...
Mark Mayo's user avatar
  • 1,923
186 votes
9 answers
26k views

Is the NHS wrong about passwords?

An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
Robin Winslow's user avatar
156 votes
17 answers
22k views

Is the BBC’s advice on choosing a password sensible?

In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows. Step 1: Choose an artist (a recording artist I presume) Lets choose as an example ...
TheJulyPlot's user avatar
  • 7,829
137 votes
11 answers
83k views

Why not allow spaces in a password?

"Your password can't contain spaces." is a message I see from some websites, including 1 . Why? (This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
David Cary's user avatar
  • 2,740
109 votes
7 answers
149k views

Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
brentonstrine's user avatar
108 votes
5 answers
39k views

How can waiting 24 hours to change the password again be secure?

So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password. Now, I wanted to change it to a more secure password but ...
ZN13's user avatar
  • 948
102 votes
3 answers
20k views

Why is Sojdlg123aljg a common password?

I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
azoundria's user avatar
  • 763
101 votes
6 answers
33k views

What is the purpose of confirming old password to create a new password?

Suppose that someone stole my password, he/she can easily change it by confirming the old password. So, I am curious that why do we need that step and what is the purpose of using old password ...
ronaldtgi's user avatar
  • 1,205
98 votes
13 answers
33k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
mika's user avatar
  • 963
97 votes
10 answers
32k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
rhymsy's user avatar
  • 1,212
88 votes
12 answers
27k views

IT will only give password over phone - but is that really more secure than email?

Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
Chris Cirefice's user avatar
75 votes
10 answers
14k views

What is worse for password strength, a poor password policy or no password policy at all?

Recently I saw the following screenshot on Twitter, describing a obviously terrible password policy: I wonder what is worse for the password strength. Having no password policy at all or a poor ...
Bob Ortiz's user avatar
  • 6,705
74 votes
10 answers
51k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
Gary's user avatar
  • 841
73 votes
8 answers
16k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
Ahmet Arslan's user avatar
71 votes
9 answers
14k views

Is password reuse a problem if the password is very strong?

I always read that using the same password on multiple sites is a risk. I'm wondering what is the real reason for this? In my case, I use the same password on multiple sites everywhere. My password ...
chocolate's user avatar
  • 827
70 votes
4 answers
10k views

Does Microsoft's "Password Ban" list insecurely store user passwords?

According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list: Microsoft says it is dynamically banning common passwords from Microsoft Account and ...
Michael come lately's user avatar
67 votes
12 answers
11k views

Do we really need a long and complicated password for websites?

Most of websites that handle important information (Gmail, for instance) have some kind of brute force protection. Sometimes if you try more than X times it will lock the account or at least give you ...
drpexe's user avatar
  • 785
66 votes
10 answers
25k views

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
JonathanReez's user avatar
  • 1,024
65 votes
5 answers
7k views

Do 2FA sites leak info by confirming a correct password guess?

Here's my relatively layman's view of the issue. Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly. ...
Ben Sandeen's user avatar
63 votes
5 answers
16k views

Is it common practice to log rejected passwords?

While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
Drew Lex's user avatar
  • 2,023
62 votes
12 answers
51k views

How long should the maximum password length be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
Mohamed's user avatar
  • 1,404
56 votes
11 answers
12k views

Why are static password requirements used so frequently?

Wouldn't it be smarter to measure password entropy and reject low entropy passwords? This would allow short passwords using the whole character set to pass, aswell as long passwords only using parts ...
HopefullyHelpful's user avatar
51 votes
5 answers
9k views

Why do many websites hide input when entering an OTP?

I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is. My understanding is that once an OTP is ...
Robin Salih's user avatar
51 votes
5 answers
6k views

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore. He called his advisor, who ...
Wulle's user avatar
  • 611
50 votes
10 answers
17k views

Confused about using a password that "would take centuries to break"

I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot. At work (finance company), I was ...
Batman's user avatar
  • 835
50 votes
3 answers
8k views

Why would a password requirement prohibit a number in the last character?

In configuring a new system today (Juniper Space, Linux-based Network Management platform), I came across a bizarre password requirement that I'm curious about. Upon logging into the web UI with the ...
HopelessN00b's user avatar
  • 3,417
49 votes
10 answers
19k views

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
Diego Pascotto's user avatar
44 votes
7 answers
7k views

Do bad passwords produce bad salted hashes?

When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak? If you setup features like limiting login ...
Crizly's user avatar
  • 2,617
40 votes
8 answers
7k views

Why do password strength requirements exist?

Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
Bozho's user avatar
  • 1,223
39 votes
8 answers
4k views

Who is responsible for the strength of user's passwords?

Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user? As a web developer, I've frequently wondered whether I should enforce the minimal password ...
Michal M's user avatar
  • 539
38 votes
5 answers
24k views

New payment option on Paypal "Enter your online banking ID + password": Any mechanism that could make this safe?

Paypal has a new payment option called "Bank Account" which says: Enter your online banking ID + password QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like ...
Nicolas Raoul's user avatar
36 votes
7 answers
13k views

What are the security risks of logging the hash of rejected passwords?

According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...
ocomfd's user avatar
  • 535
36 votes
12 answers
11k views

Is it acceptable practice to only increment a number when changing a password?

Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
user21820's user avatar
  • 613
36 votes
5 answers
4k views

Are there any guidelines for passwords that need to be read out loud?

I recently saw the movie Olympus Has Fallen. Like in many action movies, at the end a missile is launched, and the hero (Mike Banning, played by Gerard Butler) has 60 seconds to recall the launch in ...
Lea Cohen's user avatar
  • 479
36 votes
8 answers
8k views

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if ...
Michael come lately's user avatar
36 votes
2 answers
11k views

Why are passwords limited to 16 characters?

What is the reason that most websites limit to 16 characters? I would have thought the longer the password the more difficult it makes it for someone to crack it? Is it something to do with hash ...
orange's user avatar
  • 483
35 votes
12 answers
27k views

How secure are passwords made of whole english sentences

I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
student's user avatar
  • 1,473
35 votes
4 answers
10k views

Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?

I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
Hassan Saqib's user avatar
34 votes
4 answers
4k views

Is it safe to show users why their password is not allowed?

/////////////////////////////// Updated Post Below //////////////////////////// This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
Rixhers Ajazi's user avatar
34 votes
8 answers
10k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
PwdRsch's user avatar
  • 8,446
34 votes
3 answers
5k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
kinunt's user avatar
  • 2,799
34 votes
6 answers
13k views

Why do some sites prevent users from reusing their old passwords?

I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used. After all, I believe most of the ...
ajax333221's user avatar
34 votes
6 answers
6k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
Chris Cirefice's user avatar
33 votes
2 answers
10k views

What maximum password length to choose when using bcrypt?

When I generated password for GitHub with KeePass I got a message on GitHub site that said the limit for password length is 72 characters. It seemed weird it not being a power of 2 so I googled a bit ...
user1's user avatar
  • 461
32 votes
12 answers
13k views

How do I check that users don't write down their passwords?

I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
Vladimir's user avatar
  • 445
32 votes
7 answers
7k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
user389823's user avatar
31 votes
8 answers
8k views

Why isn't a client-side password complexity check considered secure? [duplicate]

I have a web application and I have implemented a check on the browser to ensure that a user sets only strong passwords. A company that we have called to check security vulnerabilities pointed out ...
Marco Altieri's user avatar
31 votes
6 answers
13k views

Do spaces in a passphrase really add any more security/entropy?

I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
v15's user avatar
  • 1,771
30 votes
6 answers
5k views

What is the point of making a complicated PUBLIC password?

I have downloaded a couple of Virtual Machine images from http://modern.ie, in order to test different versions of Internet Explorer. When running these images, a complete Windows environment is ...
Vidar S. Ramdal's user avatar

1
2 3 4 5
11