Skip to main content
Share Your Experience: Take the 2024 Developer Survey
358 votes
Accepted

What is the purpose of confirming old password to create a new password?

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.
schroeder's user avatar
  • 131k
229 votes
Accepted

Is the NHS wrong about passwords?

By any measure, they're wrong: Seven random printable ASCII: 957 = 69 833 729 609 375 possible passwords. Ten random alphabetics: 5210 = 144 555 105 949 057 024 possible passwords, or over 2000 ...
Mark's user avatar
  • 34.7k
169 votes

How do I check that users don't write down their passwords?

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers ...
dlsso's user avatar
  • 871
147 votes

What is the purpose of confirming old password to create a new password?

Two main reasons: If your session is compromised (e.g. you leave the computer and someone else jumps on, or there is a remote session compromise vulnerability), it prevents another person from ...
Matthew's user avatar
  • 27.3k
145 votes

Is displaying remaining password retry count a security risk?

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks,...
Sean Werkema's user avatar
  • 2,980
140 votes
Accepted

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

Your question contains several false assumption: If you're a security conscious user, you'd change your passwords regularly on any website that matters According to my password manager I have more ...
H. Idden's user avatar
  • 2,978
135 votes

How do I check that users don't write down their passwords?

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And ...
undo's user avatar
  • 2,125
130 votes
Accepted

How can waiting 24 hours to change the password again be secure?

By itself, the rule of only allowing one password change per day adds no security. But it often comes in addition to another rule that says that the new password must be different from the n (...
Serge Ballesta's user avatar
125 votes
Accepted

Does Microsoft's "Password Ban" list insecurely store user passwords?

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these ...
Alex Weinert's user avatar
125 votes

Why is Sojdlg123aljg a common password?

One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w. Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w ...
Mirsad's user avatar
  • 10.2k
121 votes
Accepted

IT will only give password over phone - but is that really more secure than email?

Emails are saved somewhere, whether it be on a mail server or someone's personal computer. Phone calls usually are not, unless it's a customer facing environment.
Rocket's user avatar
  • 1,160
118 votes
Accepted

Do 2FA sites leak info by confirming a correct password guess?

If I'm understanding your question properly, the attack you are proposing is to brute-force passwords against a server like this, then once it shows you the MFA screen, go try that password on other ...
Mike Ounsworth's user avatar
107 votes

Why is Sojdlg123aljg a common password?

Another possibility : Sojdlg123aljg is latin characters translation from another alphabet. For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source). ...
Lou_is's user avatar
  • 811
104 votes
Accepted

Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?

Password managers are not meant to hide your passwords from yourself It's as simple as that. To whit: most password managers let you view your own password anytime you want anyway. I say "most&...
Conor Mancone's user avatar
100 votes
Accepted

What are the security risks of logging the hash of rejected passwords?

If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same. This means that ...
Steffen Ullrich's user avatar
98 votes
Accepted

What is worse for password strength, a poor password policy or no password policy at all?

The question is: worse for what? With the policy you posted, the possible passwords are less than 64⁸ (~2.8*10¹⁴). In practice, very much passwords will probably be [a-z]*6[0-9][special char] (e.g. ...
Josef's user avatar
  • 5,953
97 votes

What is the purpose of confirming old password to create a new password?

To augment the other answers, I'll add to confirm that the keyboard is working as the user intends. Caps lock can invert the case, and Num lock can change whether typing e.g. a "4" on the keypad will ...
Spencer Joplin's user avatar
90 votes

Is the NHS wrong about passwords?

The theoretical perspective Let's do the math here. There are 26 letters, 10 digits and let's say about 10 special characters. To begin with, we assume that the password is completely random (and that ...
Anders's user avatar
  • 65.6k
89 votes

Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?

If I should never tell an admin my password (as it has been answered to the cited question) there is no reason that an admin knows my password even at the very beginning of my work in that company ...
Kolappan N's user avatar
  • 2,692
86 votes
Accepted

Confused about using a password that "would take centuries to break"

The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight ...
schroeder's user avatar
  • 131k
76 votes
Accepted

Why are static password requirements used so frequently?

After the famous XKCD strip, there were a few projects started up to deal with exactly this kind of entropy checking. One of these was the ZXCVBN password checker, made by a Dropbox employee. It is ...
ChristianF's user avatar
70 votes
Accepted

Does username length/complexity/uniqueness positively impact security?

A harder to guess username adds to the security if it's kept secret. The problems are Usernames are often not kept especially secret. On most systems allowing multiple users to log in, any user can ...
Peter Green's user avatar
  • 5,300
69 votes
Accepted

Is it acceptable practice to only increment a number when changing a password?

If an attacker has found out your password, he can access the system up until you change the password. Changing passwords often prevents attackers that already have your password to have undetected ...
Sjoerd's user avatar
  • 30.8k
67 votes

Is a 6 digit numerical password secure enough for online banking?

A 6 digit numerical password doesn't do much. Why 6 Digits? Troy Hunt has an excellent blog about being forced to create weak passwords where he talks about various bad practices including forcing ...
perfectionist's user avatar
67 votes

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

Changing passwords often is not considered a best practice anymore. People are interested in HIBP because it centralizes information regarding breaches and makes it easily accessible. Not everyone is ...
they's user avatar
  • 923
66 votes
Accepted

Is a 6 digit numerical password secure enough for online banking?

Unusual? Yes. Crazy? No. Read on to understand why... I expect your bank has a strong lockout policy, for example, three incorrect login attempts locks the account for 24 hours. If that is the case, ...
paj28's user avatar
  • 33.5k
63 votes
Accepted

Why isn't a client-side password complexity check considered secure?

You’re assuming that the check is bypassed on purpose. It could be the case that someone is using a browser which fails to handle the script properly or with scripts disabled, possibly even without ...
Teun Vink's user avatar
  • 6,908
61 votes
Accepted

What maximum password length to choose when using bcrypt?

I don't favor silent truncation because it misleads the users into thinking that their entire password was accepted when it wasn't. I'd prefer a system just set a maximum length, if necessary, and ...
PwdRsch's user avatar
  • 8,446
58 votes

IT will only give password over phone - but is that really more secure than email?

This policy is common where usernames and passwords are sent via separate channels. It doesn't matter which channels just as long as it the authentication pairs are split apart and sent via different ...
Ben's user avatar
  • 591

Only top scored, non community-wiki answers of a minimum length are eligible