359
votes
Accepted
What is the purpose of confirming old password to create a new password?
If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.
- 128k
229
votes
Accepted
Is the NHS wrong about passwords?
By any measure, they're wrong:
Seven random printable ASCII: 957 = 69 833 729 609 375 possible passwords.
Ten random alphabetics: 5210 = 144 555 105 949 057 024 possible passwords, or over 2000 ...
- 34.6k
169
votes
How do I check that users don't write down their passwords?
As others said, you can't stop them. But you can remove the incentive.
Does your password policy require any of the following?
Changing at regular intervals
Manual entering (password managers ...
- 871
166
votes
Accepted
Is the BBC’s advice on choosing a password sensible?
My question isn't about the mathematical strength of passwords which obviously will depend on the lyric that is chosen and how one goes about passwordifying it, it is more about the the predictability ...
- 22.6k
148
votes
What is the purpose of confirming old password to create a new password?
Two main reasons:
If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from ...
- 27.4k
146
votes
Is displaying remaining password retry count a security risk?
Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
- 2,984
141
votes
Accepted
Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
Your question contains several false assumption:
If you're a security conscious user, you'd change your passwords regularly on any website that matters
According to my password manager I have more ...
- 3,008
137
votes
How do I check that users don't write down their passwords?
There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper?
And ...
- 2,105
131
votes
Accepted
How can waiting 24 hours to change the password again be secure?
By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (...
- 26.5k
127
votes
Accepted
Does Microsoft's "Password Ban" list insecurely store user passwords?
We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these ...
- 796
127
votes
Why is Sojdlg123aljg a common password?
One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w.
Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w ...
- 10.2k
121
votes
Accepted
IT will only give password over phone - but is that really more secure than email?
Emails are saved somewhere, whether it be on a mail server or someone's personal computer. Phone calls usually are not, unless it's a customer facing environment.
- 1,150
118
votes
Accepted
Do 2FA sites leak info by confirming a correct password guess?
If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
- 58.8k
108
votes
Accepted
How to prevent username and password matches when changing a username?
The only sensible way to get what you want is to ask for the password when a user changes their username. This way the server always has the information needed to conduct an accurate comparison ...
- 29.5k
107
votes
Why is Sojdlg123aljg a common password?
Another possibility : Sojdlg123aljg is latin characters translation from another alphabet.
For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source).
...
- 811
104
votes
Accepted
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
Password managers are not meant to hide your passwords from yourself
It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most&...
- 31k
100
votes
Accepted
What are the security risks of logging the hash of rejected passwords?
If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same.
This means that ...
- 199k
99
votes
Accepted
What is worse for password strength, a poor password policy or no password policy at all?
The question is: worse for what?
With the policy you posted, the possible passwords are less than 64⁸ (~2.8*10¹⁴). In practice, very much passwords will probably be [a-z]*6[0-9][special char] (e.g. ...
- 5,973
98
votes
What is the purpose of confirming old password to create a new password?
To augment the other answers, I'll add to confirm that the keyboard is working as the user intends.
Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will ...
- 1,096
90
votes
Is the BBC’s advice on choosing a password sensible?
It's horrible :) To provide some numbers to back claims by other answers:
This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits ...
- 931
90
votes
Is the NHS wrong about passwords?
The theoretical perspective
Let's do the math here. There are 26 letters, 10 digits and let's say about 10 special characters. To begin with, we assume that the password is completely random (and that ...
- 65.4k
90
votes
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
If I should never tell an admin my password (as it has been answered
to the cited question) there is no reason that an admin knows my
password even at the very beginning of my work in that company
...
- 2,682
86
votes
Accepted
Confused about using a password that "would take centuries to break"
The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight ...
- 128k
76
votes
Accepted
Why are static password requirements used so frequently?
After the famous XKCD strip, there were a few projects started up to deal with exactly this kind of entropy checking. One of these was the ZXCVBN password checker, made by a Dropbox employee.
It is ...
- 826
70
votes
Accepted
Does username length/complexity/uniqueness positively impact security?
A harder to guess username adds to the security if it's kept secret.
The problems are
Usernames are often not kept especially secret. On most systems allowing multiple users to log in, any user can ...
- 5,200
70
votes
Accepted
Is it acceptable practice to only increment a number when changing a password?
If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected ...
- 29.6k
68
votes
Is a 6 digit numerical password secure enough for online banking?
A 6 digit numerical password doesn't do much.
Why 6 Digits?
Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing ...
- 749
68
votes
Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
Changing passwords often is not considered a best practice anymore.
People are interested in HIBP because it centralizes information regarding breaches and makes it easily accessible. Not everyone is ...
- 923
66
votes
Accepted
Is a 6 digit numerical password secure enough for online banking?
Unusual? Yes. Crazy? No. Read on to understand why...
I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, ...
- 33.4k
Only top scored, non community-wiki answers of a minimum length are eligible