Chapter 1 of 6 · 4 practices · 4 min · 4-question quiz
Password rules and storage
What passwords to accept, what to reject, and how to store them so a database leak does not hand out working credentials.
Start: Require length, not complexity rules4 practices in this chapter
- 1Require length, not complexity rulesRules like "one uppercase, one digit, one symbol" push people toward
Password1!, which every cracking list already contains. NIST SP 800-63B-4 says verifiers must not impose composition rules and… - 2Check new passwords against a blocklist of common and breached valuesLength alone still lets through
passwordpasswordand passwords already leaked from other sites. NIST requires checking every new password against a blocklist of commonly used, expected or… - 3Let password managers work, and drop forced rotation and hintsPassword managers are the easiest way for people to use long, unique passwords. NIST says verifiers must allow password managers and autofill and should allow pasting. Blocking paste on the password…
- 4Hash passwords with Argon2id and tuned parametersStore passwords with a slow, salted, memory-hard hash so that a leaked table takes enormous effort to crack. OWASP's Password Storage Cheat Sheet gives these minimums: Libraries generate a unique…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.