359 votes

What is the purpose of confirming old password to create a new password?

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.
schroeder's user avatar
  • 128k
229 votes

Is the NHS wrong about passwords?

By any measure, they're wrong: Seven random printable ASCII: 957 = 69 833 729 609 375 possible passwords. Ten random alphabetics: 5210 = 144 555 105 949 057 024 possible passwords, or over 2000 ...
Mark's user avatar
  • 34.6k
169 votes

How do I check that users don't write down their passwords?

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers ...
dlsso's user avatar
  • 871
166 votes

Is the BBC’s advice on choosing a password sensible?

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability ...
Mark Buffalo's user avatar
  • 22.6k
148 votes

What is the purpose of confirming old password to create a new password?

Two main reasons: If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from ...
Matthew's user avatar
  • 27.4k
146 votes

Is displaying remaining password retry count a security risk?

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
Sean Werkema's user avatar
  • 2,984
141 votes

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

Your question contains several false assumption: If you're a security conscious user, you'd change your passwords regularly on any website that matters According to my password manager I have more ...
H. Idden's user avatar
  • 3,008
137 votes

How do I check that users don't write down their passwords?

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And ...
undo's user avatar
  • 2,105
131 votes

How can waiting 24 hours to change the password again be secure?

By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (...
Serge Ballesta's user avatar
127 votes

Does Microsoft's "Password Ban" list insecurely store user passwords?

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these ...
Alex Weinert's user avatar
127 votes

Why is Sojdlg123aljg a common password?

One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w. Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w ...
Mirsad's user avatar
  • 10.2k
121 votes

IT will only give password over phone - but is that really more secure than email?

Emails are saved somewhere, whether it be on a mail server or someone's personal computer. Phone calls usually are not, unless it's a customer facing environment.
Rocket's user avatar
  • 1,150
118 votes

Do 2FA sites leak info by confirming a correct password guess?

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
Mike Ounsworth's user avatar
108 votes

How to prevent username and password matches when changing a username?

The only sensible way to get what you want is to ask for the password when a user changes their username. This way the server always has the information needed to conduct an accurate comparison ...
tim's user avatar
  • 29.5k
107 votes

Why is Sojdlg123aljg a common password?

Another possibility : Sojdlg123aljg is latin characters translation from another alphabet. For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source). ...
Lou_is's user avatar
  • 811
104 votes

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Password managers are not meant to hide your passwords from yourself It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most&...
Conor Mancone's user avatar
100 votes

What are the security risks of logging the hash of rejected passwords?

If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same. This means that ...
Steffen Ullrich's user avatar
99 votes

What is worse for password strength, a poor password policy or no password policy at all?

The question is: worse for what? With the policy you posted, the possible passwords are less than 64⁸ (~2.8*10¹⁴). In practice, very much passwords will probably be [a-z]*6[0-9][special char] (e.g. ...
Josef's user avatar
  • 5,973
98 votes

What is the purpose of confirming old password to create a new password?

To augment the other answers, I'll add to confirm that the keyboard is working as the user intends. Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will ...
Spencer Joplin's user avatar
90 votes

Is the BBC’s advice on choosing a password sensible?

It's horrible :) To provide some numbers to back claims by other answers: This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits ...
Ordous's user avatar
  • 931
90 votes

Is the NHS wrong about passwords?

The theoretical perspective Let's do the math here. There are 26 letters, 10 digits and let's say about 10 special characters. To begin with, we assume that the password is completely random (and that ...
Anders's user avatar
  • 65.4k
90 votes

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

If I should never tell an admin my password (as it has been answered to the cited question) there is no reason that an admin knows my password even at the very beginning of my work in that company ...
Kolappan N's user avatar
  • 2,682
86 votes

Confused about using a password that "would take centuries to break"

The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight ...
schroeder's user avatar
  • 128k
76 votes

Why are static password requirements used so frequently?

After the famous XKCD strip, there were a few projects started up to deal with exactly this kind of entropy checking. One of these was the ZXCVBN password checker, made by a Dropbox employee. It is ...
ChristianF's user avatar
70 votes

Does username length/complexity/uniqueness positively impact security?

A harder to guess username adds to the security if it's kept secret. The problems are Usernames are often not kept especially secret. On most systems allowing multiple users to log in, any user can ...
Peter Green's user avatar
  • 5,200
70 votes

Is it acceptable practice to only increment a number when changing a password?

If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected ...
Sjoerd's user avatar
  • 29.6k
68 votes

Is a 6 digit numerical password secure enough for online banking?

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing ...
perfectionist's user avatar
68 votes

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

Changing passwords often is not considered a best practice anymore. People are interested in HIBP because it centralizes information regarding breaches and makes it easily accessible. Not everyone is ...
they's user avatar
  • 923
66 votes

Is a 6 digit numerical password secure enough for online banking?

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, ...
paj28's user avatar
  • 33.4k

Only top scored, non community-wiki answers of a minimum length are eligible