We’re rewarding the question askers & reputations are being recalculated! Read more.
167

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers blocked) Complex format (differing cases, special characters, etc.) If so, you are actively incentivizing people to write the password down. Drop the outdated ...


148

Locking accounts is a bad idea in the first place. It might seem like you're making your organization more secure by keeping out "bad people" who are "guessing" at passwords using brute force attacks, but what have you really solved? Even with this policy and a perfect userbase who never makes security mistakes, an attacker can perform a denial-of-service ...


141

Your question contains several false assumption: If you're a security conscious user, you'd change your passwords regularly on any website that matters According to my password manager I have more than hundreds of accounts and most of them would do harm to me if compromised. Changing all of them regularly (like every 90 days) is a huge amount of work. So ...


138

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And even if you did have access to all their devices, you can only check that they haven't written down the password if you, as a sysadmin, yourself know the password....


123

One of the most logical explanations is that those accounts were associated with a bot. Same goes for password like 18atcskd2w. Graham Cluley wrote an article about this: So, Just Why Is 18atcskd2w Such a Popular Password? Can so many people really be choosing to protect their online accounts with the same, seemingly random choice of “18atcskd2w”, “...


105

Another possibility : Sojdlg123aljg is latin characters translation from another alphabet. For instance, a common password "ji32k7au4a83" is from mandarin "我的密碼", meaning "my password" (source). Using this online keyboard, you can validate that typing successively j-i-3 maps to 我. However it does not works for Soj... So either it is a different language, ...


90

If I should never tell an admin my password (as it has been answered to the cited question) there is no reason that an admin knows my password even at the very beginning of my work in that company One of the main reasons to this rule is that Admins should not access your confidential data such as mails, etc... Since there is no data associated with the ...


68

Changing passwords often is not considered a best practice anymore. People are interested in HIBP because it centralizes information regarding breaches and makes it easily accessible. Not everyone is a security conscious user, but the information is valuable to all users because regardless of your password age practice the password should be changed ...


64

I'm basing my answer on the assumption that a One-Time Password is used as a second factor, in addition to a traditional username/password combination. If this is not the case, and the One-Time Password is the only factor, then Gilles' Answer is certainly more applicable. Most likely due to Cargo Cult Programming, which means blindly following patterns that ...


48

As John Deters has noted, 2x8 is almost certainly worse - but the reasons why take a little explaining. There were a couple of problems with LANMAN hashes (the classic case of breaking a password in half, gone awry): Since passwords tend to be human-generated and somewhat short, if a single password was only a little longer than the first half (say, 8 ...


38

90 days is more than enough to profit from stolen credentials (however strong they are). Moreover, most passwords will vary only by a digit or two when changed, so even a password older than 90 days will allow an attacker to guess the new one fairly easily. If your passwords are strong (randomly generated by password managers) and one still manged to leak ...


32

It depends on your lockout mechanism. If invalid logins get reset after some time AND a locked account does not get unlocked, showing a counter can help an attacker not to lock out an account. But a skilled attacker will have determined the lockout policy up front and will take this into account when guessing the password. So the impact is limited. Also, ...


32

Changing passwords regularly actually tends to reduce security, as people end up using repeated patterns. The recommendations are to use strong passwords, unique to each service, and only change when a compromise is suspected. HIBP gives that notification of compromise.


31

The reason to hide passwords is to prevent shoulder surfing: someone being physically present (or someone observing through a camera) might be able to read the password on the screen. This is also a risk for a one-time password, but to a much lesser extent for two reasons: the one-time password is only valid for a short time, and it's displayed on the OTP ...


29

In a small company, it is likely that the administrator that sets up a new employee's machine is also the administrator of the company emails and document servers. In which case, the admin is already able to read your emails or send an email as you at all time without ever needing access to your machine. If this is the case, then there is no new security ...


20

Install a camera behind their desk, better yet multiple cameras to cover all angles, and have somebody watch them. You might be bothered by this being unethical but don't worry, it's in no way worse than almost any other way that achieves what you want to do. About that almost: Use "passwords" that cannot be reasonably represented in plaintext by a user. ...


19

You don't. By forbidding users to write down their passwords, you're forbidding them to use the second-best password manager in existence. People are generally quite good at protecting the contents of their wallets; a list of complex passwords written on a piece of paper stored between their driver's license and their credit card is about as secure as you ...


18

I'm going to approach this question from a different direction. Your question is based on the assumption that the account is the responsibility and/or property of the new user at the moment it is created, but that's not really true. When the account is created, it belongs to the IT department, not to the user. The initial setup you describe is ...


16

What is your threat model? I know I ask that counter-question to almost everything here, but most question about security never state what they actually try to secure against. Are unauthorized people regularily in your environment and could spot passwords that are written down? If so, awareness in your users can be improved to this specific and easily ...


16

Speculating about the motive of other developers is perhaps a poor use of time, but I can see one advantage that hasn't been mentioned. Psychologically, making it look like a password helps people associate it with security. It transfers the message we have pushed for decades that "you don't tell people your password" to OTPs, and hopefully helps a few more ...


13

First off, I agree with the answers that say that this is a bad idea for a variety of reasons. Second, it appears that you are trying to use technology to solve a human problem. It is very, very rare for that to end well. Instead of focusing on technical measures to prevent writing passwords down, such as cameras, non-pasteable password fields, and so on, ...


8

Starting from math point of view ... (to simplify calculation I assume only digit passwords) Situation A: 2 parts 8 digit password, 'bruteforce attack on part one require max 10^8 hashes, same for part. Total of max 2*10^8 hashes required ' Situation B: 1 part 9 ...


8

Assuming the policy on sequential numbers is very defensive and concerns the following digit, and assuming that 9 is followed by 0, this reduce the number of available passcodes to 10*8^5=327.680 Which reduce the possibility to a subset containing 32.76% of the original possibilities, which is not that much different on a scale. However, such a rule ...


7

is the configuration made by admin AS THE USER an acceptable practice? Yes it is. As with all practices it depends on the context. But generally speaking this is a common and acceptable practice, given that you have a basic level of trust in your admins and not a super high level of security need, like when you guard state secrets. It is okay, despite the ...


7

Generally it recommended to use a personal account for everything you do. Logs will show who did what. That's why admins don't just all log in with "root" or "Administrator", but have their own accounts: you can tell who did what, and you can easily revoke the administrator's credentials without changing the password for all administrators. Users have ...


7

It comes in handy when your email address has been exposed but not as part of a credentials set. As an example, I had an email address included in a breach but I didn't have an account with that service/product, the breach was actually on a marketing tool used by a service/product that I was using and my email address had been added to the tool for marketing ...


6

In SQL, prepared statements often use the ? as a placeholder. If they used parameterised queries but did not sanitise the inputs, then starting the password with a ? could confuse their code and result in an error. This does not mean that this requirement is justified. It means that they know that they have insecure/buggy code and are forcing the users to ...


6

You're trying to fix a human issue with a technical solution. And tbh, I fail to see how your increase in iterations will "incentivize users to use longer passwords" even with your suggestion that users would "feel" the difference in speed in longer vs. shorter passwords. Bumping iterations will not be noticeable to a user unless you set it to a ridiculous ...


5

You are right to be suspicious about this service. The automatic login after account creation doesn't really bother me too much. The only reason it's not commonly used is that websites typically like to verify the email address in the case of an account needing to be reset, if you don't have a verified email, how can they do that reliably? The bit of them ...


5

In principle, no, it should not be a security risk. If it were, then you would be relying on security through obscurity (hidden information). Hiding a count would, at best, be a minor inconvenience to an adversary. In contrast, hiding a count can be a significant inconvenience to legitimate users. It's not uncommon that I sometimes enter the wrong ...


Only top voted, non community-wiki answers of a minimum length are eligible