All Questions
7 questions
26
votes
10
answers
6k
views
How to strike a balance between security policies and practical implementation challenges? [duplicate]
At our organization, we came across some frequent incidents such as:
Reported successful password guessing attacks
Frequent password reset complaints
We started an investigation to identify the ...
- 2,037
9
votes
2
answers
2k
views
Is there value in changing your password after failed (malicious) login attempts?
I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your ...
7
votes
4
answers
2k
views
Should users be allowed to reset their password to the current one?
I've been trying to answer the following question but can't seem to find a clear answer...
When a user resets their password after forgetting it, should they be allowed to change it to the password ...
- 801
108
votes
5
answers
40k
views
How can waiting 24 hours to change the password again be secure?
So I managed to change my password on a service to the "wrong" password, for simplicity let's just say I changed it to an insecure password.
Now, I wanted to change it to a more secure password but ...
- 948
0
votes
1
answer
165
views
Steps to secure an account where an attacker keeps resetting the password [closed]
I have an account on a major company website that has for some reason fallen under attack. Periodically over the course of the day I will get a text message from the company saying your password has ...
- 918
3
votes
1
answer
11k
views
Why must new password must be different from old
When changning my password ive come across this below message a few times:
Your new password must be different from your previous password.
What is the rationale behind such implementation?
EDIT:
...
- 131
1
vote
3
answers
344
views
Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?
I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with.
After resetting the password, I went to enter my password, and ...
- 907