A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

7
votes
8answers
1k views

Are you obliged to provide old employers with access to protected resources?

Firstly, a disclaimer. This question is not because I'm a disgruntled employee planning to hide some malicious code which I can later blackmail my employer with. I actually quite like the people I ...
9
votes
1answer
868 views

Is there an official standard regarding user password storage practices?

I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
5
votes
5answers
902 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
4
votes
4answers
2k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
19
votes
7answers
411 views

Citations for inadvisability of globally unique password

I am having a disagreement with someone (a client) about the user identification/authentication process for a system. The nub of it is that they want each user to have a globally unique password ...
11
votes
5answers
2k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
11
votes
6answers
2k views

Why do websites restrict the number & choice of characters in a password?

Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of ...