User Castaglia

1261 votes

22 answers

274k views

XKCD #936: Short complex password, or long dictionary passphrase?

Billy ONeal

2,688

asked Aug 10, 2011 at 21:38

918 votes

11 answers

299k views

How to securely hash passwords?

appsec cryptography passwords hash

AviD♦

71.8k

asked Nov 12, 2010 at 12:36

859 votes

14 answers

166k views

What technical reasons are there to have low maximum password lengths?

passwords password-policy

enderland

7,901

asked Mar 30, 2013 at 21:30

615 votes

23 answers

149k views

How does changing your password every 90 days increase security?

authentication passwords password-management

Bill the Lizard

6,701

asked Jun 22, 2011 at 13:36

592 votes

7 answers

202k views

How to store salt?

passwords hash salt

George

6,107

asked Jul 20, 2012 at 6:28

497 votes

8 answers

494k views

RSA vs. DSA for SSH authentication keys

encryption cryptography authentication key-management ssh

jrdioko

13k

asked Jul 8, 2011 at 23:22

249 votes

10 answers

83k views

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

malware ransomware wannacry

Rory McCune

60.7k

asked May 12, 2017 at 19:02

245 votes

16 answers

393k views

Provide subjectAltName to openssl directly on the command line

certificates openssl bash

Michael Seiwald

2,583

asked Dec 5, 2014 at 12:38

223 votes

13 answers

27k views

Is there any reason to not show users incorrectly entered passwords after a successful login?

authentication passwords

RaunakS

2,043

asked Sep 9, 2016 at 18:35

220 votes

4 answers

90k views

Recommended # of iterations when using PBKDF2-SHA256?

cryptography passwords appsec hash pbkdf2

Tails

2,388

asked May 19, 2011 at 22:32

186 votes

9 answers

25k views

Is the NHS wrong about passwords?

passwords password-policy entropy

Robin Winslow

1,738

asked Oct 6, 2016 at 20:31

172 votes

26 answers

22k views

Convince people not to share their password with trusted others

passwords defense trust user-education persec

Auzias

1,518

asked Sep 26, 2016 at 8:35

158 votes

7 answers

251k views

Why most people use 256 bit encryption instead of 128 bit?

cryptography encryption

H M

2,877

asked Apr 23, 2012 at 5:16

157 votes

17 answers

22k views

Is the BBC’s advice on choosing a password sensible?

passwords password-policy password-cracking

TheJulyPlot

7,629

asked Jan 20, 2016 at 16:26

152 votes

11 answers

86k views

https security - should password be hashed server-side or client-side?

web-application passwords tls authentication hash

johndodo

1,755

asked Nov 2, 2011 at 10:13

137 votes

8 answers

67k views

How hard is it to intercept SMS (two-factor authentication)?

authentication mobile multi-factor phone sms

Paul Podlipensky

2,817

asked Feb 8, 2012 at 2:41

133 votes

6 answers

47k views

How secure are the FIDO U2F tokens

authentication multi-factor one-time-password fido

tylerl

81.9k

asked Oct 22, 2014 at 5:55

132 votes

10 answers

16k views

Should I contact the manufacturer if their product allows access to other users' location information?

disclosure geolocation url design-flaw

Lil' Bits

1,153

asked Jan 9, 2017 at 21:18

127 votes

7 answers

105k views

Let's Encrypt for intranet websites?

tls certificates letsencrypt

LoukiosValentine79

1,531

asked Oct 23, 2015 at 16:06

125 votes

7 answers

44k views

My ISP uses deep packet inspection; what can they observe?

privacy vpn internet isp

cppanonhelp666

1,233

asked Mar 27, 2017 at 17:33

123 votes

3 answers

173k views

Session Authentication vs Token Authentication

authentication cookies session-management token

Hoax

2,705

asked Feb 16, 2015 at 9:04

122 votes

7 answers

64k views

Is using Git for deploying a bad practice?

webserver apache source-code

Septagram

1,323

asked Nov 14, 2013 at 7:37

107 votes

5 answers

31k views

How can waiting 24 hours to change the password again be secure?

passwords password-policy password-reset

ZN13

928

asked Apr 3, 2017 at 9:36

105 votes

14 answers

14k views

Could keystroke timing improve security on a password?

passwords

Moo-Juice

1,132

asked Apr 28, 2016 at 19:31

105 votes

11 answers

204k views

How dangerous is it to reveal your date of birth, and why?

identity-theft persec

user541686

2,474

asked Jul 27, 2015 at 6:55

102 votes

5 answers

84k views

How to check if an SSH private key has passphrase or not?

public-key-infrastructure ssh passphrase

kung

1,219

asked Jul 11, 2016 at 11:18

99 votes

7 answers

17k views

Attacker circumventing 2FA. How to defend?

multi-factor

TheJulyPlot

7,629

asked Jun 7, 2017 at 15:08

97 votes

7 answers

21k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

ssh ftp sftp

Stéphane C.

972

asked Apr 28, 2016 at 7:47

96 votes

6 answers

6k views

Should passwords be automatically reset when the underlying method changes

password-management user-management

Crazy Dino

1,517

asked Mar 21, 2016 at 14:03

94 votes

5 answers

84k views

What is the specific reason to prefer bcrypt or PBKDF2 over SHA256-crypt in password hashes?

passwords hash bcrypt

ilkkachu

2,066

asked Aug 8, 2016 at 12:21

Stack Exchange Network

current community

your communities

more stack exchange communities

222 Bookmarks

XKCD #936: Short complex password, or long dictionary passphrase?

How to securely hash passwords?

What technical reasons are there to have low maximum password lengths?

How does changing your password every 90 days increase security?

How to store salt?

RSA vs. DSA for SSH authentication keys

How is the "WannaCry" Malware spreading and how should users defend themselves from it?

Provide subjectAltName to openssl directly on the command line

Is there any reason to not show users incorrectly entered passwords after a successful login?

Recommended # of iterations when using PBKDF2-SHA256?

Is the NHS wrong about passwords?

Convince people not to share their password with trusted others

Why most people use 256 bit encryption instead of 128 bit?

Is the BBC’s advice on choosing a password sensible?

https security - should password be hashed server-side or client-side?

How hard is it to intercept SMS (two-factor authentication)?

How secure are the FIDO U2F tokens

Should I contact the manufacturer if their product allows access to other users' location information?

Let's Encrypt for intranet websites?

My ISP uses deep packet inspection; what can they observe?

Session Authentication vs Token Authentication

Is using Git for deploying a bad practice?

How can waiting 24 hours to change the password again be secure?

Could keystroke timing improve security on a password?

How dangerous is it to reveal your date of birth, and why?

How to check if an SSH private key has passphrase or not?

Attacker circumventing 2FA. How to defend?

Does FTPS (FTP+S) offer better security than SFTP on the server side?

Should passwords be automatically reset when the underlying method changes

What is the specific reason to prefer bcrypt or PBKDF2 over SHA256-crypt in password hashes?