User: Password:
|
|
Subscribe / Log in / New account

seven basic rules for developers setting up password systems

seven basic rules for developers setting up password systems

Posted Oct 22, 2011 6:56 UTC (Sat) by alecmuffett (guest, #80935)
Parent article: Enforcing password strength

If any part of your user interface or code truncates password plaintext input at a length of less than 255 characters, it's a bug.

If you can't cope with password plaintexts that contain SPACE and TAB characters, it's a bug.

If your passwords are not hashed, it's a bug.

If you're hashing your passwords with anything other than Bcrypt, it's a bug; bcrypt() maxes out at 55 character passwords, but that's not your fault...

If you allow people to use a password of less than 12 characters, it's a bug.

If you do not encourage people to select a unique password for your service, it's a bug.

If you do not encourage people to use passphrases, it's a bug.

Yes, the rules are opinionated. They are even biased and make sweeping assumptions. They don't even address issues like UNICODE. But if you address these seven points in every application in the world, you'll make password cracking a phenomenally tougher job.

Background: http://goo.gl/iL9EP


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds