361
votes
Accepted
What is the purpose of confirming old password to create a new password?
If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.
- 132k
230
votes
Accepted
Is the NHS wrong about passwords?
By any measure, they're wrong:
Seven random printable ASCII: 957 = 69 833 729 609 375 possible passwords.
Ten random alphabetics: 5210 = 144 555 105 949 057 024 possible passwords, or over 2000 ...
- 34.8k
169
votes
How do I check that users don't write down their passwords?
As others said, you can't stop them. But you can remove the incentive.
Does your password policy require any of the following?
Changing at regular intervals
Manual entering (password managers ...
- 871
147
votes
What is the purpose of confirming old password to create a new password?
Two main reasons:
If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from ...
- 27.4k
145
votes
Is displaying remaining password retry count a security risk?
Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
- 2,980
140
votes
Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
Your question contains several false assumption:
If you're a security conscious user, you'd change your passwords regularly on any website that matters
According to my password manager I have more ...
- 2,963
135
votes
How do I check that users don't write down their passwords?
There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper?
And ...
- 2,155
131
votes
Accepted
How can waiting 24 hours to change the password again be secure?
By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (...
- 26.9k
126
votes
Why is Sojdlg123aljg a common password?
One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w.
Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w ...
- 10.2k
121
votes
Accepted
IT will only give password over phone - but is that really more secure than email?
Emails are saved somewhere, whether it be on a mail server or someone's personal computer. Phone calls usually are not, unless it's a customer facing environment.
- 1,160
107
votes
Why is Sojdlg123aljg a common password?
Another possibility : Sojdlg123aljg is latin characters translation from another alphabet.
For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source).
...
- 811
104
votes
Accepted
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
Password managers are not meant to hide your passwords from yourself
It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most&...
- 31.7k
100
votes
Accepted
What are the security risks of logging the hash of rejected passwords?
If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same.
This means that ...
- 208k
97
votes
What is the purpose of confirming old password to create a new password?
To augment the other answers, I'll add to confirm that the keyboard is working as the user intends.
Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will ...
- 1,086
90
votes
Is the NHS wrong about passwords?
The theoretical perspective
Let's do the math here. There are 26 letters, 10 digits and let's say about 10 special characters. To begin with, we assume that the password is completely random (and that ...
- 65.8k
89
votes
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
If I should never tell an admin my password (as it has been answered
to the cited question) there is no reason that an admin knows my
password even at the very beginning of my work in that company
...
- 2,732
88
votes
Accepted
Confused about using a password that "would take centuries to break"
The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight ...
- 132k
76
votes
Accepted
Why are static password requirements used so frequently?
After the famous XKCD strip, there were a few projects started up to deal with exactly this kind of entropy checking. One of these was the ZXCVBN password checker, made by a Dropbox employee.
It is ...
- 826
67
votes
Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
Changing passwords often is not considered a best practice anymore.
People are interested in HIBP because it centralizes information regarding breaches and makes it easily accessible. Not everyone is ...
- 923
63
votes
Accepted
Why isn't a client-side password complexity check considered secure?
You’re assuming that the check is bypassed on purpose. It could be the case that someone is using a browser which fails to handle the script properly or with scripts disabled, possibly even without ...
- 6,948
61
votes
Accepted
What maximum password length to choose when using bcrypt?
I don't favor silent truncation because it misleads the users into thinking that their entire password was accepted when it wasn't. I'd prefer a system just set a maximum length, if necessary, and ...
- 8,466
58
votes
IT will only give password over phone - but is that really more secure than email?
This policy is common where usernames and passwords are sent via separate channels.
It doesn't matter which channels just as long as it the authentication pairs are split apart and sent via different ...
- 591
56
votes
IT will only give password over phone - but is that really more secure than email?
Emails may (though as @Luc points out, not always) be sent in plaintext across the internet. That means they may be logged by your email provider, your ISP, your recipient's ISP, your recipient's ...
- 59.3k
56
votes
Should a bank be able to shorten your password without your involvement?
Most likely the bank always used just 20 characters.
As Affe already suggested in the comments, the simplest explanation is that nothing has actually changed in the way the bank stores the passwords. ...
- 851
55
votes
Accepted
Why would a password requirement prohibit a number in the last character?
It's likely an effort to discourage passwords that fit common formats or character masks. If a password policy requires use of a number many people will chose to put their number at the end of a word ...
- 8,466
54
votes
Are there joint password accounts? (Like bank accounts)
It's generally undesirable to have multiple people knowing the same password.
Instead, systems that requires multiple user to be able to access the same resources usually requires each user to create ...
- 31.6k
52
votes
What considerations do I need to keep in mind when enforcing passphrases?
It is not necessarily a bad idea. The attacker can know the password is in that format, considering the 4 words are random enough. But here is the thing, there are other good ways to make a memorable ...
- 7,858
52
votes
Accepted
Does a password policy with a restriction of repeated characters increase security?
In general, no, such a policy is counterproductive to security. While many weak passwords use repeated characters, so do many strong passwords... and many weak passwords don't.
Some reasons not to use ...
- 52.1k
Only top scored, non community-wiki answers of a minimum length are eligible