Are the password restrictions really necessary? Are people storing their SSN and Bank Account info on Stack Overflow?
122428
Why the crazy password requirements? It a Q&amp;A site, and I have to conform to arbitrarily chosen password complexity criteria.  With a 22 random lowercase characters (entropy 119 bits), the  asks me to:    Just adding uppercase characters to the mix does not satisfy the requirements.  With 125 bits of entropy, It still asks me to:    Fortunately, doing either of these does satisfy the requirements. As long as there are enough unique characters.  The password a1ᓕ♵Ŀꁏꂯ (with a1 replacing Unicode characters to satisfy the numbers and letters requirement, reducing the level of entropy from 112 to 88 bits) still causes the generator to insist that the password:    Sadly, the famous  password doesn't fly, either:    I add entropy in my passwords in other ways than the Password1 (entropy approximately 0) mechanism suggested by these requirements, and prefer to use the Stack Exchange OpenID provider.
9987
Someone in another state asked me to be his personal assistant.  From the start I was suspicious.  He said he was doing a lot of projects in my state and needed my help.  Then he said he needed to transfer some money to my account (via mobile), but in order to do so he requires my full name, account number, username, and password.  I've never heard of this.  Please advise, as this sounds really weird and risky!
71325
I have noticed that by signing on to Stack&nbsp;Overflow, I am also signed on to my email account. But when I log out, it only logs me out of the site without logging me out of my email. This means I am running around saying "hey, you should XSS me". Is this specific to the way OpenID behaves, or is it specific to the way Stack&nbsp;Overflow implemented it?
6464
Any  at all will obviously help when salting and hashing a user's password.  Are there any best practices for how long the salt should be?  I'll be storing the salt in my user table, so I would like the best tradeoff between storage size and security.  Is a random 10 character salt enough? Or do I need something longer?
117115
Given:   We are getting lots of problems with the quality of questions from new users. The unwillingness to register shows a lack of commitment to the site and hence is a good indication that the person will not spend the time learning how to post good questions. We are getting a lot more questions than we need, it could be claimed that Stack Overflow is becoming less useful due to the volume of questions.   Should unregistered users only be allowed to answer questions and not post questions?  In the old days Stack Overflow benefited from lots of questions being asked, so it made sense to make it easy for anyone to ask questions,  I no longer see the bandit from increasing the already great volume of questions.  (The site I use other the Stack Overflow, don’t seem to be getter the same problems with the volume of poor questions.)    The way I think of it is when a nation is first formed, anyone including convicts are let in, but once something worthwhile has been built, a system is put in place to only allow in people that are a net benefit to the current residence.   I am now thinking that a lot of the new unregister users that are asking questions will never become a net benefit to the current committed users.
18677
What measures can/should I take to make sure that security around my SSH server is absolutely impermeable?  This will be community wiki from the start, so lets see what people do to secure their servers.
104445
I am wondering because I am trying to make sure that person have right amount of spaces for their user name.  User Name and Password are security measures and should not be easy to guess. I have fixed amount of characters to Passwords no shorter than 6 characters because most sites use 6-8 characters when create an account. Because of limitation of my progams database file I cannot have passwords longer than 20 characters. What about User Name field? Too short User Name would be too easy to guess, too long, might cause program errors (since maximum length of single line TextBox in .Net/C# is about 32767 characters).  What should be the maximum and minimum length of User Name and Password fields?
29549
I have noticed there is a Stack Overflow in language differs from English which is global and mostly used by programmers.  I think there is no need for a site in other languages. Otherwise we will end up with 127 StackOverflow sites. I am afraid that we will lose the amount of people sharing data.
100244
My Bank of America checks contain my routing &amp; account number, which I've used in the past to make purchases online, among other things. Anyone whom I pay with a check has this information. It seems like this account info is even more sensitive than my credit card #, since with Visa I am protected with a Zero Liability policy, but I do not know that to be the case for my checking account.  I may be naive, but there's a lot of people I've paid with checks whom I would never give my credit card (e.g. people I've bought from on Craigslist). I'm now wondering if it's irrational to do this.
22136
The sidebar of the StackApps  states:     You'll also receive parameters for authentication users via OAuth 2.0.   I believe this should read:     You'll also receive parameters for authenticating users via OAuth 2.0.
89290
I wish to know all the pros and cons about using these two methods. In particular the implications on web security.  Thanks.
64831
Good morning, please, has anyone used logins audit without using the Profile?  My client needs an audit that displays the logins that connected to the bank and after they disconnected.  In the case the profiler believe it is too heavy to keep active all the time collecting.  Do you have anything that might help us in this case?  thank you Carol Lavecchia
76533
The current top-voted to  states:     Another one that's not so much a security issue, although it is security-related, is complete and abject failure to grok the difference between hashing a password and encrypting it. Most commonly found in code where the programmer is trying to provide unsafe "Remind me of my password" functionality.   What exactly is this difference? I was always under the impression that hashing was a form of encryption. What is the unsafe functionality the poster is referring to?
19989
. . . or is it set up so that I must have at least one account per site to participate? And if the latter, is there an easy way to keep my profile information synced across all the sites that I am a member of?  I would prefer to have just one login, password, personal description, picture, etc. to remember and maintain.
104197
When i create new User Account and login with that credentials, it gives me this problem if admin doesnt have set thier values yet !!!**  AllotmentList = [select id, Days_Remaining__c from PTO_Allotment__c where Year__c =:year and Employee__c=:EmployeeList[0].id LIMIT 100]; //access only Current user Allotment details                 //to handle Listoutof Bound Exception wrote if-else          if(AllotmentList.size()&gt;0)         {         requests.PTO_Allotment__c=AllotmentList[0].id;         requests.Days_Remaining__c=AllotmentList[0].Days_Remaining__c;         }         else         {             //write a code when AllotmentList is empty ....         }
66554
I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks?  I'm worried because I saw a lot of locked out.
23474
Possible Duplicate:        I am talking about surepuser, serverfault and stackoverflow altogether.  There are two reason for this opinion, one is philosophical and the other is practical. Let me start with the philosophical first.   mail.google.com, reader.google.com and www.google.com provides three different functionalities, yet, same person, log in once, and he's logged in to all of them.  In practice, many developers are ending up installing their software on server machines, many of them are required to maintain these bytes regularly or even build some other tools that will do this for automatically (serverfault.com) - That's why I see no reason having two separate accounts for the same  senior developers usually can be considered as power users, so why would it be a different for the very same developer when posting a question or answering one on suerpuser.com.  and most of all, having meta.stackoverflow on a separate account is totally mistaken - imagine a guy scoring 27k on stackoverflow. One day, this fellow has an idea how to improve the site so to make it even easier to answer questions.  If this fellow answered 12k questions a year, his suggestion must be considered differently that one who answered 3 question a year, right? Since he's a proven heavy user of the site and a major contributor. Yet, when he will first login to the meta.so and create the account one will not notice their stackoverflow activity and might ignore their feature request altogether.