1671

Take five chimpanzees. Put them in a big cage. Suspend some bananas from the roof of the cage. Provide the chimpanzees with a stepladder. BUT also add a proximity detector to the bananas, so that when a chimp goes near the banana, water hoses are triggered and the whole cage is thoroughly soaked. Soon, the chimps learn that the bananas and the stepladder ...


348

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.


272

It's a leftover from the time when keypads didn't have the letters Q and Z. Security-wise, there's no reason. It's just because of old systems. To clarify: You used to be able to enter your password over the phone. Some phones didn't have the letters Q or Z, like the one on the picture below. Image courtesy: Bill Bradford on flickr.com Because of ...


225

By any measure, they're wrong: Seven random printable ASCII: 957 = 69 833 729 609 375 possible passwords. Ten random alphabetics: 5210 = 144 555 105 949 057 024 possible passwords, or over 2000 times as many. Length counts. If you're generating your passwords randomly, it counts for far more than any other method of making them hard to guess.


224

These restrictions are often put in place for various reasons: Interaction with legacy systems that do not support long passwords. Convention (i.e. "we've always done it that way") Simple naivety or ignorance. As far as security goes, there is no need to limit password lengths. They should be hashed anyway, using a KDF such as bcrypt. To help with ...


168

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers blocked) Complex format (differing cases, special characters, etc.) If so, you are actively incentivizing people to write the password down. Drop the outdated ...


163

My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability of the total amount of possible passwords that are likely to pop up using this method. This is a good question, and I'm going to depart from the norm here, ...


148

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks, but what have you really solved? Even with this policy and a perfect userbase who never makes security mistakes, an attacker can perform a denial-of-service ...


143

Two main reasons: If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from changing the password, locking you out of your own account. If you are enforcing a password change, you can then check that the old and new passwords don't match, ...


141

Your question contains several false assumption: If you're a security conscious user, you'd change your passwords regularly on any website that matters According to my password manager I have more than hundreds of accounts and most of them would do harm to me if compromised. Changing all of them regularly (like every 90 days) is a huge amount of work. So ...


140

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And even if you did have access to all their devices, you can only check that they haven't written down the password if you, as a sysadmin, yourself know the password....


135

There's several possibilities. They could be storing the full password in plaintext, and only displaying the last 4 characters to the support person. They could be hashing the password twice. Once hashing the full password, and again with just the last 4. Then the support person types in the last 4 to see if it matches the hashed value. The problem with ...


130

By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (generally 2 or 3) previous ones. The one change per day rule is an attempt to avoid this trivial perversion: a user has to change his password because it has reached ...


123

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these passwords unless the attacks change. The attack lists generally derive from studying breaches. Attackers are smart enough to look at lists to figure out high ...


122

One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w. Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w Such a Popular Password? Can so many people really be choosing to protect their online accounts with the same, seemingly random choice of “18atcskd2w”, “...


120

A lone password is not necessarily verifiable by itself. In particular, if the server does things properly, then it stores not the passwords themselves, but the output of a password hashing function computed over the password. A password hashing function (as opposed to a mere hash function) includes some extra features, including a salt (for very good ...


119

Emails are saved somewhere, whether it be on a mail server or someone's personal computer. Phone calls usually are not, unless it's a customer facing environment.


118

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other websites that this user has accounts on. This is a great question! Good find! But you seem to be overlooking two points: This is no weaker than not having MFA, ...


108

The only sensible way to get what you want is to ask for the password when a user changes their username. This way the server always has the information needed to conduct an accurate comparison between the username and password during a change, and prevent matches. As sensitive operations - such as changing passwords, or in your case usernames - should ...


106

Another possibility : Sojdlg123aljg is latin characters translation from another alphabet. For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source). Using this online keyboard, you can validate that typing successively j-i-3 maps to 我. However it does not works for Soj... So either it is a different language, ...


103

I can't explain it as anything beyond legacy madness, or lazily copying username restrictions to password restrictions without forethought. Any block of data, printable or otherwise, should be acceptable if you're hashing your passwords. The only restrictions should be a minimum complexity and a "sanity" maximum length so somebody doesn't soak up 1MB of ...


100

If you do not divulge your "password requirements" then your users will hate you. Some will not succeed in finding an "acceptable password" and will call the helpdesk. Or, worse, if the users are customers then they will go buy elsewhere. A great way to kill your own business ! On the other hand, if divulging your "password requirements" really help ...


100

If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same. This means that almost none of the analysis you want to do can be done with the properly hashed (i.e. random salt) passwords in the first place, i.e. you gain almost nothing ...


98

The question is: worse for what? With the policy you posted, the possible passwords are less than 64⁸ (~2.8*10¹⁴). In practice, very much passwords will probably be [a-z]*6[0-9][special char] (e.g. aabaab1!) and similar passwords. All possible passwords with the same characters and length less than 8 are just 64⁷+64⁶+64⁵+... which is ~4.5*10¹². Thats a lot ...


94

To augment the other answers, I'll add to confirm that the keyboard is working as the user intends. Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will instead move the cursor left. Some interfaces show a warning, but many don't. Most OSs have software keyboard layouts. Being able to type your old password ...


91

If I should never tell an admin my password (as it has been answered to the cited question) there is no reason that an admin knows my password even at the very beginning of my work in that company One of the main reasons to this rule is that Admins should not access your confidential data such as mails, etc... Since there is no data associated with the ...


90

It's horrible :) To provide some numbers to back claims by other answers: This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits per year! Average word count for a song is 300-600, depending on the style, and they do 7-10 words per sentence (And I imagine that's the comfortable length of a ...


89

The theoretical perspective Let's do the math here. There are 26 letters, 10 digits and let's say about 10 special characters. To begin with, we assume that the password is completely random (and that a character in one group is not more likely to be used than a character in another group). The number of possible passwords can then be written as C = s^n ...


87

The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight into how an attacker might choose to break the password. For instance, if I know that you use a pattern, and what that pattern is, then I would adjust my ...


Only top voted, non community-wiki answers of a minimum length are eligible