A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource.

learn more… | top users | synonyms

5
votes
3answers
5k views

How does a web browser save passwords?

How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
9
votes
7answers
2k views

Password hashing and support to your user

We've recently moved to a better password storage strategy, with it came all the good stuff: Passwords are stored after going through bCrypt User is sent an activation link on account creation to ...
9
votes
9answers
3k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
11
votes
3answers
472 views

Storing passwords for usage in scripts

There are few situations that require users to provide their password while automating things during development process. Site deployment is only one of the common situations. Creating dmg files under ...
3
votes
4answers
308 views

Password insanity! Recommended approaches to password management on multiple client systems? [closed]

A software development company I work with has a web based product they are successfully selling to clients. All of these clients have a support agreement with us that generally requires us to access ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
35
votes
9answers
2k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
5
votes
3answers
2k views

Is there any legislation requiring how we store passwords? [closed]

Given the Sony data breach and other events recently, is there any actual laws or regulation regarding how to store passwords? I think there are with credit cards, you're not allowed to store the 3 ...
27
votes
14answers
1k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
16
votes
1answer
1k views

Is there an official standard regarding user password storage practices?

I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
5
votes
5answers
954 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
6
votes
4answers
3k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
19
votes
7answers
427 views

Citations for inadvisability of globally unique password

I am having a disagreement with someone (a client) about the user identification/authentication process for a system. The nub of it is that they want each user to have a globally unique password ...
12
votes
5answers
2k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
11
votes
6answers
3k views

Why do websites restrict the number & choice of characters in a password? [duplicate]

Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of ...