| |||||||||||||
seven basic rules for developers setting up password systemsseven basic rules for developers setting up password systemsPosted Oct 22, 2011 6:56 UTC (Sat) by alecmuffett (guest, #80935)Parent article: Enforcing password strength
If any part of your user interface or code truncates password plaintext input at a length of less than 255 characters, it's a bug.
If you can't cope with password plaintexts that contain SPACE and TAB characters, it's a bug.
If your passwords are not hashed, it's a bug.
If you're hashing your passwords with anything other than Bcrypt, it's a bug; bcrypt() maxes out at 55 character passwords, but that's not your fault...
If you allow people to use a password of less than 12 characters, it's a bug.
If you do not encourage people to select a unique password for your service, it's a bug.
If you do not encourage people to use passphrases, it's a bug.
Yes, the rules are opinionated. They are even biased and make sweeping assumptions. They don't even address issues like UNICODE. But if you address these seven points in every application in the world, you'll make password cracking a phenomenally tougher job.
Background: http://goo.gl/iL9EP
(Log in to post comments)
|
|||||||||||||