New answers tagged

1 vote

Why don't bank verification services use OAuth

Why aren't they doing this? There needs to be a standard API for this which third party services could use. While OAuth2 and OpenID Connect could provide such API in general it needs to be configured ...
Steffen Ullrich's user avatar
1 vote

base64 encoding inflight credentials

The “browser console” is a debug and development tool which is designed to show anything you transmit over the line (among other things). Having your password in a POST request in there is not really ...
LvB's user avatar
  • 8,488
0 votes

Best login flow for username and password authentication

Authentication systems are complicated (honestly, too much so for a single question). Most web app frameworks include at least part of one in-box, and if you want to write your own, you're at ...
CBHacking's user avatar
  • 45.4k
-1 votes

Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

Is there any professional consensus on what the optimal password minimum length requirement should be? There are two common opinions about this: eight characters minimum longer is better NIST says ...
Sjoerd's user avatar
  • 29.1k
1 vote

Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)

The motivation for the University of Michigan seems to be to encourage the use of passphrase / diceware. See Guidelines for a Secure Password, where 3 of the 4 tips are related to that. In practice, I'...
tim's user avatar
  • 29.4k
0 votes

How important is it for WiFi passwords to be secure?

With Wifi passwords, as with all passwords, usability is often opposed to security. A strong password can be hard to remember and error-prone when you type it. But you can easily remember a weak ...
v-g's user avatar
  • 261
6 votes

How can Linkedin access my account without asking for my password?

They don't need the password to change anything on your account. They own every single bit of information about you. To change your email, for instance, they just edit the email on your record, and ...
ThoriumBR's user avatar
  • 52.8k
1 vote

How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?

Without any trickery, the simplest way to do this is when a password change is requested, require the previous password as well. After verification of the previous password against the current hash, ...
captainmish's user avatar
0 votes

XKCD #936: Short complex password, or long dictionary passphrase?

My simples users point of view In complement to all previous answer I will just add some reflexions and return from my usage and some users. My usage I've read this strip more than ten years ago today....
0 votes

Should I be concerned that my bank told me that I have a strong password?

I'm guessing this simply means that they improved their password requirements at some point in the ~recent past and that your password was set after that. Perhaps they only changed how they store your ...
Adam Katz's user avatar
  • 10.8k
2 votes

Extract Keepass password generator dictionary

The Keepass password generator is well documented. And it approaches the ideal of a password generator in that knowledge of the scheme used to generate the password doesn't make it meaningfully weaker....
Jeffrey Goldberg's user avatar
1 vote

Extract Keepass password generator dictionary

There's no such list. Keepass generates random passwords when you request it to. There's no pattern, and keepass authors are quite focused on security, so it's unlikely that they use low quality ...
vidarlo's user avatar
  • 15.2k

Top 50 recent answers are included