WebAppSec/Secure Coding Guidelines: Difference between revisions

Jump to navigation Jump to search

WebAppSec/Secure Coding Guidelines (view source)

Revision as of 21:55, 4 January 2011

508 bytes removed ,  4 January 2011
→‎Password Complexity
Line 27: Line 27:


===Password Complexity===
===Password Complexity===
====Critical Sites ====
All sites should have the following base password policy:
Examples: any admin/power user login or for all users on a website that has sensitive user data


Implement the following policy:
* Passwords must be 8 characters or greater
* Passwords must be 8 characters or greater
* Passwords must require numbers and letters and a special character
* Passwords must require letters and numbers
 
====Critical Sites ====
Examples: addons.mozilla.org, bugzilla.mozilla.org, or other critical
sites.


==== Non-Critical Sites ====
Critical sites should add the following requirements to the password policy:
Examples: No personnel user data stored, minimal impact of compromised account
* Besides the base policy, passwords should also require at least one or
more special characters.


Note:
* account lockout must still be in place for 3 failed attempts
* This policy is only for basic accounts. Any admin accounts must still adhere to the strict password policy identified above.


Implement the following policy:
==== Global Disallowed Passwords ====
* Passwords must be 6 characters or greater
We should have lists where people pull from where user users can't use
* Password must require any two of the following three categories of characters:
these passwords. Right off the bat, we should disallow "password" and
** numbers
anything like it such as "p@$$w0rd".
** letters
** special character
* Disallow the following passwords (case insensitive):
** password1 (or any number at the end)
** abc123
** trustno1
** ncc1701
** rush2112
** thx1138
** Note: This list was created by identifying passwords from the [http://www.whatsmypass.com/the-top-500-worst-passwords-of-all-time top 100 most common passwords] that would be possible with the identified password complexity policy.
* plain dictionary words blocking should also be considered


* http://www.whatsmypass.com/the-top-500-worst-passwords-of-all-time


===Password Rotation===
===Password Rotation===
Mcoates
Confirmed users
491

edits

Retrieved from "https://wiki.mozilla.org/Special:MobileDiff/275742"

Navigation menu