Questions tagged [password-policy]
A set of requirements regarding password creation, storage, and usage. These requirements often constrain several characteristics of passwords. So, a password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly.
504
questions
886
votes
14
answers
175k
views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
- 8,181
235
votes
7
answers
48k
views
Why would you not permit Q or Z in passwords?
Jetblue's password requirements specify that, among other stringent requirements:
Cannot contain a Q or Z
I can't fathom a logical reason for this, unless it were say, extremely common for the ...
- 1,913
186
votes
9
answers
26k
views
Is the NHS wrong about passwords?
An NHS doctor I know recently had to do their online mandatory training questionnaire, which asks a bunch of questions about clinical practice, safety and security. This same questionnaire will have ...
- 1,758
157
votes
17
answers
22k
views
Is the BBC’s advice on choosing a password sensible?
In this article on the BBC’s website they offer advice on how to develop a password. The steps are as follows.
Step 1: Choose an artist (a recording artist I presume)
Lets choose as an example ...
- 7,789
137
votes
11
answers
80k
views
Why not allow spaces in a password?
"Your password can't contain spaces."
is a message I see from some websites,
including 1 .
Why?
(This question is very similar to Why Disallow Special Characters In a Password? , but the answers ...
- 2,730
109
votes
7
answers
149k
views
Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?
Justin Schuh defended Google's reasoning in the wake of this post detailing the "discovery" (sic) that passwords saved in the Chrome password manager can be viewed in plaintext. Let me just directly ...
- 1,259
108
votes
5
answers
36k
views
How can waiting 24 hours to change the password again be secure?
So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password.
Now, I wanted to change it to a more secure password but ...
- 948
102
votes
3
answers
20k
views
Why is Sojdlg123aljg a common password?
I was going through the list of top 100K passwords and found Sojdlg123aljg near the top of the list. Does anyone have any idea why this is such a common password?
- 753
101
votes
6
answers
32k
views
What is the purpose of confirming old password to create a new password?
Suppose that someone stole my password, he/she can easily change it by confirming the old password.
So, I am curious that why do we need that step and what is the purpose of using old password ...
- 1,205
99
votes
13
answers
32k
views
Is a 6 digit numerical password secure enough for online banking?
My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
- 973
98
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 1,222
89
votes
12
answers
27k
views
IT will only give password over phone - but is that really more secure than email?
Every year an automated password reset occurs on a VPN account that I use to connect to the institution's servers. The VPN accounts/passwords are managed by the institution's IT department, so I have ...
- 1,460
75
votes
10
answers
14k
views
What is worse for password strength, a poor password policy or no password policy at all?
Recently I saw the following screenshot on Twitter, describing a obviously terrible password policy:
I wonder what is worse for the password strength. Having no password policy at all or a poor ...
- 6,661
75
votes
10
answers
50k
views
Why Disallow Special Characters In a Password?
The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
- 851
73
votes
8
answers
16k
views
Is displaying remaining password retry count a security risk?
Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
- 849
72
votes
9
answers
14k
views
Is password reuse a problem if the password is very strong?
I always read that using the same password on multiple sites is a risk. I'm wondering what is the real reason for this?
In my case, I use the same password on multiple sites everywhere. My password ...
- 837
70
votes
4
answers
10k
views
Does Microsoft's "Password Ban" list insecurely store user passwords?
According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list:
Microsoft says it is dynamically banning common passwords from Microsoft Account and ...
- 2,613
67
votes
10
answers
24k
views
Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
- 1,034
67
votes
12
answers
11k
views
Do we really need a long and complicated password for websites?
Most of websites that handle important information (Gmail, for instance) have some kind of brute force protection. Sometimes if you try more than X times it will lock the account or at least give you ...
- 785
65
votes
5
answers
7k
views
Do 2FA sites leak info by confirming a correct password guess?
Here's my relatively layman's view of the issue.
Many websites tout multifactor authentication (MFA) as an enormous boost to the security of users' accounts, and it can be if implemented properly.
...
- 777
63
votes
5
answers
15k
views
Is it common practice to log rejected passwords?
While selecting unique passwords for each purpose is a great idea, in practice this rarely happens. Therefore many select passwords from a personal pool of passwords that are easily remembered. When ...
- 2,023
62
votes
12
answers
50k
views
How long should the maximum password length be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
- 1,404
56
votes
11
answers
12k
views
Why are static password requirements used so frequently?
Wouldn't it be smarter to measure password entropy and reject low entropy passwords?
This would allow short passwords using the whole character set to pass, aswell as long passwords only using parts ...
- 1,244
51
votes
10
answers
17k
views
Confused about using a password that "would take centuries to break"
I am talking about this password - 23##24$$25%%26 and the similar ones consisting of special characters appearing in a pattern, which the users these days use a lot.
At work (finance company), I was ...
- 845
51
votes
5
answers
9k
views
Why do many websites hide input when entering an OTP?
I've noticed that on many sites, when they ask for a one-time password (OTP) (usually sent by SMS), the input is hidden in the same way as a password field is.
My understanding is that once an OTP is ...
- 572
51
votes
5
answers
6k
views
Should a bank be able to shorten your password without your involvement?
The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who ...
- 611
50
votes
10
answers
19k
views
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
Somehow related to this other question. I am dealing with the following case: a medium-large company (with about 200 on-premises employees) is applying the following procedure for all the newly ...
- 601
50
votes
3
answers
8k
views
Why would a password requirement prohibit a number in the last character?
In configuring a new system today (Juniper Space, Linux-based Network Management platform), I came across a bizarre password requirement that I'm curious about. Upon logging into the web UI with the ...
- 3,407
44
votes
7
answers
7k
views
Do bad passwords produce bad salted hashes?
When you have a password stored in a database that has been strongly hashed and salted does it really matter if the underlying user password is weak?
If you setup features like limiting login ...
- 2,617
40
votes
8
answers
7k
views
Why do password strength requirements exist?
Password strength is now everything, and they force you to come up with passwords with digits, special characters, upper-case letters and whatnot. Apart from being a usability nightmare (even I as a ...
- 1,213
40
votes
8
answers
4k
views
Who is responsible for the strength of user's passwords?
Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user?
As a web developer, I've frequently wondered whether I should enforce the minimal password ...
- 549
38
votes
5
answers
23k
views
New payment option on Paypal "Enter your online banking ID + password": Any mechanism that could make this safe?
Paypal has a new payment option called "Bank Account" which says:
Enter your online banking ID + password
QUESTION: To me it sounds unsafe (ie: sends my password to a third-party organization like ...
- 1,276
37
votes
12
answers
11k
views
Is it acceptable practice to only increment a number when changing a password?
Note: I'm not asking about this password scheme is the best or not (of course it isn't); I'm asking about its theoretical or practical secureness relative to the optimal password scheme based on the ...
- 623
36
votes
7
answers
13k
views
What are the security risks of logging the hash of rejected passwords?
According to Is it common practice to log rejected passwords?, I know logging rejected plain text password is a bad idea, but how about if I store the hashed form of rejected passwords? I want to have ...
- 535
36
votes
8
answers
8k
views
Is it a mistake to use a password that has previously been used (by anyone ever)?
A few months ago, kutschkem answered a question about HIBP with this:
Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 if ...
- 2,613
36
votes
2
answers
11k
views
Why are passwords limited to 16 characters?
What is the reason that most websites limit to 16 characters?
I would have thought the longer the password the more difficult it makes it for someone to crack it?
Is it something to do with hash ...
- 483
35
votes
5
answers
3k
views
Are there any guidelines for passwords that need to be read out loud?
I recently saw the movie Olympus Has Fallen.
Like in many action movies, at the end a missile is launched, and the hero (Mike Banning, played by Gerard Butler) has 60 seconds to recall the launch in ...
- 469
35
votes
4
answers
10k
views
Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?
I am developing an application in PHP and it uses bcrypt encryption to store passwords. I want to keep the history of hashes whenever the user changes the password. By doing this I want to stop the ...
- 526
34
votes
4
answers
4k
views
Is it safe to show users why their password is not allowed?
/////////////////////////////// Updated Post Below ////////////////////////////
This question has received a lot of hits, more than I ever thought it would have on such a basic topic. So, I thought I ...
- 489
34
votes
8
answers
10k
views
How to prevent username and password matches when changing a username?
Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
- 8,416
34
votes
3
answers
5k
views
Is there a security reason for a site to limit the number of times a user can change their password?
Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it.
One reason I ...
- 2,789
34
votes
6
answers
13k
views
Why do some sites prevent users from reusing their old passwords?
I have always wondered why it is that bad to reuse old passwords; it should not be the end of the world if we happen to use an old password that we previously used.
After all, I believe most of the ...
- 451
34
votes
12
answers
27k
views
How secure are passwords made of whole english sentences
I often read as an advice to build strong passwords, just to think about a sentence and then take the initial letters. For example take a nonsense sentence like "I watch Grey's Anatomy at 9.40" gives ...
- 1,453
34
votes
6
answers
6k
views
What is the point in having arbitrary username requirements?
I've looked around on Security.SE, but couldn't find much related to the following problem:
I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
- 1,460
32
votes
12
answers
13k
views
How do I check that users don't write down their passwords?
I have a password policy which states that users must not write and store their passwords down in plaintext. How can I ensure that they haven't done so by writing their password in emails, scripts, ...
- 445
32
votes
2
answers
10k
views
What maximum password length to choose when using bcrypt?
When I generated password for GitHub with KeePass I got a message on GitHub site that said the limit for password length is 72 characters. It seemed weird it not being a power of 2 so I googled a bit ...
- 451
31
votes
7
answers
7k
views
Does username length/complexity/uniqueness positively impact security?
Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security?
This is assuming that adversaries aren'...
- 625
31
votes
8
answers
8k
views
Why isn't a client-side password complexity check considered secure? [duplicate]
I have a web application and I have implemented a check on the browser to ensure that a user sets only strong passwords.
A company that we have called to check security vulnerabilities pointed out ...
- 653
31
votes
4
answers
11k
views
The registration confirmation email contains my password: do they keep it in plaintext?
I was kind of shocked when I just received my confirmation mail from the shop where I just registered myself: they sent my username (which is my email address) and the password I typed in. The ...
- 413
31
votes
6
answers
12k
views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
- 1,761