100

If you do not divulge your "password requirements" then your users will hate you. Some will not succeed in finding an "acceptable password" and will call the helpdesk. Or, worse, if the users are customers then they will go buy elsewhere. A great way to kill your own business ! On the other hand, if divulging your "password requirements" really help ...


64

I'm basing my answer on the assumption that a One-Time Password is used as a second factor, in addition to a traditional username/password combination. If this is not the case, and the One-Time Password is the only factor, then Gilles' Answer is certainly more applicable. Most likely due to Cargo Cult Programming, which means blindly following patterns that ...


40

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


33

Yes, it is bad security practice indeed. When using the Forgotten Password feature, the site should respond with a message: "An email has just been sent to the specified email address, if it exists and is registered within our system. Please read the email and follow the instructions." Or simply: "Please check your email inbox for instructions on how to ...


31

The reason to hide passwords is to prevent shoulder surfing: someone being physically present (or someone observing through a camera) might be able to read the password on the screen. This is also a risk for a one-time password, but to a much lesser extent for two reasons: the one-time password is only valid for a short time, and it's displayed on the OTP ...


28

Update 09/2018: While I previously stated that this might be a good option, the world has changed, and the use of EV is no longer a particularly reliable indicator, even given the drawbacks mentioned below. There are articles such as this one from Troy Hunt which explain the full issue, but, in short, browsers are no longer treating EV certificates as ...


27

If you don't tell the user exactly what's needed in his password to go through the validation of your function, how would he know what to add or modify to make it valid? Giving such information could result in making a bruteforce attack easier. However, considering your requirements, it doesn't help the attacker at all because there are too many password ...


26

From a security control perspective, all it really does is slow down the ability of automated password probing software to perform their task of trying out multiple passwords. The site is hoping an attacker may choose a "softer" target instead of their site. As an actual security control, this technique is not particularly effective. Also, specifically ...


17

The underlying idea of the comic is that separation of user accounts has been designed for mainframes: big computers, shared by many users. In that model, the potential attackers are other users. Account separation is then about protecting users from other users; only the god-like admin account can access everything on the machine, and the administrator has ...


17

Users/customers will most likely restrain from using your service once their third attempt at entering a valid password failed. Hackers in contrast will try to register arbitrarily often to figure out your password requirements as precise as possible. To counter this, validate the user first via the usual means (email, captcha etc) and send them a password ...


16

Speculating about the motive of other developers is perhaps a poor use of time, but I can see one advantage that hasn't been mentioned. Psychologically, making it look like a password helps people associate it with security. It transfers the message we have pushed for decades that "you don't tell people your password" to OTPs, and hopefully helps a few more ...


15

There's a reason few websites follow that "security" measure: you lose usability (and users) without gaining any security. Any website with even the smallest hint of security will enforce a limit on the amount of times you can "guess" a password OR a username, to prevent people iterating over all of the existing usernames. This limit needs to be imposed on ...


8

Think about the scenario -- how does the attacker get the requirements? Most likely because they can register themselves. In which case it is trivial to reverse engineer your requirements unless they are too complex to use without an explanation. So, yes, it's safe to let the user know what your requirements are. But a better approach is to not require a ...


5

The answer to this depends on the nature of the site. I actually think the UX benefits of telling them if the information provided was correct or not, but only if it doesn't impact security. There are plenty of sites where you are able to enumerate usernames is multiple ways, and they are that way by design. For example, if you wanted to enumerate ...


4

Skeuomorphic design is tempting: To differentiate a product from its competitors; but at the cost of reinventing the (UI) wheel and creating absurd learning hurdles for users. No website should be so unique as to exceed a user's motivation to learn how to use it. For security, there are few consequences of using skeuomorphic design (especially where ...


4

I would add this as a comment if I had the rep but the typical user reaction would be to click through. Your average user has no clue about SSL. As a side note, at my place of employment, our ERP throws an error message due to an unverfiable certificate. The solution to this problem (according to the help desk) is to click through it. I assume most users ...


4

I believe you're confusing the purpose of a salt. You can derive a salt from an infinite amount of ways, but that doesn't change the purpose of the salt. And for the salt's purpose, it need not be secret. So when reviewing critiques on your salt derivation, just understand that you're getting this feedback based on the purpose of the salt. Other than that, ...


4

The dilemma is not specific to security, but security makes it easier to solve (although not in a philosophically satisfactory way). Consider the Web browser Firefox. It is very self-contained. For instance, it has its own cryptographic layer, with its own storage of private keys and handling of certificates and SSL implementation and list of trust anchors. ...


4

Recommendations to management need to be framed in terms of effort, costs, and risks. 'Best Practices' and marketing-speak will not communicate well on their own, so defining the problem in terms of effort, costs, and risks will keep everyone focused on the realities of the situation. Your 'outsider' is not helping the discussion with tossing around a ...


4

Try not to see security from the developer's point of view, but instead, follow a set of best practices. For example, you will be accepting input from a user, in the form of a file upload or text input, sanitize the content nonetheless, look at the answers to this question for tips on how to sanitize user defined css. I would not assume that the css may ...


4

Every new service or program can pose a new security risk because they can have their own vulnerabilities. X11 has their own CVE's, for instance. Then when you access it over something like VNC, you introduce other potential problems and possibilities for misconfigurations. So, yes, there are inherent risks, but nothing specific for GUIs.


4

I like how the GDPR states: "implement appropriate technical and organisational measures". Now you should take a risk based approach to define appropriate. In sensitive cases like second love this would be totally different then for a more generic service like social media. So no you are not persee exaggerating, but it does depends on the risk context, and ...


4

It's an interesting question, because I never thought of this problem, but it is indeed a privacy issue. The problem is that certain procedures actually leak information, which can even be sensitive information. To avoid this, your application would have to appear to behave in exactly the same way in every case where sensitive information might be leaked. ...


3

Nope. It makes absolutely zero improvement in security and disables a normally useful feature. As you're probably well aware, there's a number of shortcuts that work to do all the things you've mentioned like F2 to rename files, Ctrl+C for copy, Ctrl+v for paste. It does absolutely nothing to prevent keyloggers, screen cappers, viruses/malware etc. To ...


3

What we're talking here is security boundaries. The boundary between a user physically on a local machine and the SYSTEM context (whichever OS that may be) is there to protect the system. There is also a security boundary between the user on the system and the various applications the user runs, usually by way of the application's own auth mechanism. That ...


3

I have seen this used by many provides as a way to do Home Realm Discovery, when many IDPs are involved. When a user types their email address in, the next screen will be the IDP or in case of many possible choices, a selection list, followed by a redirection. Another possibility is that this technique confuses password managers, or built in chrome "...


3

NB: This is an open research problem, and there are several people currently doing research on communicating the security provided by end-to-end encrypted chat applications. So there is no research coming to our rescue here, only design thinking. Another note: there is no such thing as a security / usability trade-off. There's design principles, constraints ...


3

Is there any real security implication about allowing doing this? No. Lets look at each of these things: disabling right click There is no security benefit to this at all, as there is no dangerous action that is performed with a right click. Some websites disable right click so that users can't copy or save images easily, but this can of course be ...


2

It depends on your environment. For a lot of users it's another layer of security which is basically telling the user to rethink what they are doing in hopes that if it is something bad, they won't do it. However a lot of users will instantly click yes and not even think about it. I personally have my UAC set to "Notify me only when programs try to make ...


Only top voted, non community-wiki answers of a minimum length are eligible