3 ms·

I have a question about the password policy. All sites should have the following base password policy: Passwords must be 8 characters or greater P

by rohit89 15y ago

I have a question about the password policy. All sites should have the following base password policy: Passwords must be 8 characters or greater Passwords must require letters and numbers Blacklisted passwords should be implemented (contact infrasec for the list) Is it responsibility of the website to make sure that the passwords are strong for the general user ? Isn't it the user's responsibility to create a good password ? I would think that the site should let the user know about best practices but ultimately it should be up to the user whether to follow it or not.

nbpoole 15y ago
Is it responsibility of the website to make sure that the passwords are strong for the general user ? Yes. If a password is too weak and it results in a user's account getting compromised, the website gets the blame. Thus, the website mandates the password policy. And depending on the site, weak passwords and compromised accounts directly impact other users. Imagine if eBay had no password policy and some of their largest sellers had their accounts compromised as a result; what impact would that have on buyers?
gcv 15y ago
Enforcing password strength makes sense for a site which stores sensitive data. That said, some simple math suggests that length, not character complexity, should be required. http://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase http://security.stackexchange.com/questions/6095/xkcd-936-sh...
- starwed 15y ago
  I wonder if there are any sites that simply forbid passwords that are known to exist in rainbow tables.
  - shabble 15y ago
    I'd assume that's what they're talking about with the 'use blacklist'. It'd be easy enough to occasionally repopulate it with "obvious" or known-compromised passwords that turn up. Likewise, I assume they're keeping that list semi-secure to avoid black-hats/kiddies getting their hands on a list of really good passwords to throw into their cracking engine ruleset.

by rohit89 15y ago

nbpoole 15y ago

Is it responsibility of the website to make sure that the passwords are strong for the general user ? Yes. If a password is too weak and it results in a user's account getting compromised, the website gets the blame. Thus, the website mandates the password policy. And depending on the site, weak passwords and compromised accounts directly impact other users. Imagine if eBay had no password policy and some of their largest sellers had their accounts compromised as a result; what impact would that have on buyers?

gcv 15y ago

Enforcing password strength makes sense for a site which stores sensitive data. That said, some simple math suggests that length, not character complexity, should be required. http://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase http://security.stackexchange.com/questions/6095/xkcd-936-sh...

starwed 15y ago
I wonder if there are any sites that simply forbid passwords that are known to exist in rainbow tables.
- shabble 15y ago
  I'd assume that's what they're talking about with the 'use blacklist'. It'd be easy enough to occasionally repopulate it with "obvious" or known-compromised passwords that turn up. Likewise, I assume they're keeping that list semi-secure to avoid black-hats/kiddies getting their hands on a list of really good passwords to throw into their cracking engine ruleset.