new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/password_strength

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Password minimum length without MFA

If MFA is not enabled, passwords shorter than 15 characters are considered to be weak according to NIST SP800-63B.

Password maximum length must support passphrases

Maximum password length should be at least 64 characters to allow passphrases according to NIST SP800-63B. Note that certain implementations of hashing algorithms may cause long password denial of service.

Do not silently truncate passwords

Passwords should not be silently truncated. The Password Storage Cheat Sheet provides further guidance on how to handle passwords that are longer than the maximum length.

Allow all characters in passwords including unicode and whitespace

Passwords should allow usage of all characters including unicode and whitespace. There should be no password composition rules limiting the type of characters permitted. There should be no requirement for upper or lower case or numbers or special characters.

Avoid requiring periodic password changes

Avoid requiring periodic password changes. Instead, encourage users to pick strong passwords and enable Multifactor Authentication. According to NIST guidelines, verifiers should not mandate arbitrary password changes. Credential rotation should occur when a password leak occurs, at the time of compromise identification, or when authenticator technology changes.

Include password strength meter using zxcvbn

Include a password strength meter to help users create a more complex password. The zxcvbn-ts library can be used for this purpose. Other language implementations of zxcvbn are listed at https://github.com/dropbox/zxcvbn, but check the age and maturity of each example before use.

Block common and breached passwords using Pwned Passwords API

Block common and previously breached passwords. Pwned Passwords is a service where passwords can be checked against previously breached passwords. Details on the API are at https://haveibeenpwned.com/API/v3#PwnedPasswords. Alternatively, download the Pwned Passwords database using https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader to host it yourself.

Alternative password blocklists from NCSC and SecLists

Alternative top password lists include: Various password lists hosted by SecLists from Daniel Miessler at https://github.com/danielmiessler/SecLists/tree/master/Passwords, and a static copy of the top 100,000 passwords from Have I Been Pwned hosted by NCSC in text format at https://www.ncsc.gov.uk/static-assets/documents/PwnedPasswordsTop100k.txt and JSON format at https://www.ncsc.gov.uk/static-assets/documents/PwnedPasswordsTop100k.json. However, there is no guarantee as to how updated these lists are.

Give your agent this brain