New answers tagged passwords
1
vote
Why don't bank verification services use OAuth
Why aren't they doing this?
There needs to be a standard API for this which third party services could use. While OAuth2 and OpenID Connect could provide such API in general it needs to be configured ...
- 196k
1
vote
base64 encoding inflight credentials
The “browser console” is a debug and development tool which is designed to show anything you transmit over the line (among other things).
Having your password in a POST request in there is not really ...
- 8,488
0
votes
Accepted
Best login flow for username and password authentication
Authentication systems are complicated (honestly, too much so for a single question). Most web app frameworks include at least part of one in-box, and if you want to write your own, you're at ...
- 45.4k
-1
votes
Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)
Is there any professional consensus on what the optimal password minimum length requirement should be?
There are two common opinions about this:
eight characters minimum
longer is better
NIST says ...
- 29.1k
1
vote
Optimal password minimum length requirement? (In particular, does a 15 character minimum make sense for most university users?)
The motivation for the University of Michigan seems to be to encourage the use of passphrase / diceware. See Guidelines for a Secure Password, where 3 of the 4 tips are related to that.
In practice, I'...
- 29.4k
0
votes
How important is it for WiFi passwords to be secure?
With Wifi passwords, as with all passwords, usability is often opposed to security.
A strong password can be hard to remember and error-prone when you type it. But you can easily remember a weak ...
- 261
6
votes
Accepted
How can Linkedin access my account without asking for my password?
They don't need the password to change anything on your account. They own every single bit of information about you. To change your email, for instance, they just edit the email on your record, and ...
- 52.8k
1
vote
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
Without any trickery, the simplest way to do this is when a password change is requested, require the previous password as well. After verification of the previous password against the current hash, ...
- 241
0
votes
XKCD #936: Short complex password, or long dictionary passphrase?
My simples users point of view
In complement to all previous answer I will just add some reflexions and return from my usage and some users.
My usage
I've read this strip more than ten years ago today....
0
votes
Should I be concerned that my bank told me that I have a strong password?
I'm guessing this simply means that they improved their password requirements at some point in the ~recent past and that your password was set after that.
Perhaps they only changed how they store your ...
- 10.8k
2
votes
Extract Keepass password generator dictionary
The Keepass password generator is well documented. And it approaches the ideal of a password generator in that knowledge of the scheme used to generate the password doesn't make it meaningfully weaker....
- 6,520
1
vote
Extract Keepass password generator dictionary
There's no such list.
Keepass generates random passwords when you request it to. There's no pattern, and keepass authors are quite focused on security, so it's unlikely that they use low quality ...
- 15.2k
Top 50 recent answers are included