Set a Password Policy

Background Information

Computer users have to remember a number of passwords for multiple applications. You've probably been told several times to create a password that is unique and meets specific requirements. Like most people, you choose a pattern that you will remember the next time you log in. Unfortunately, these patterns are as obvious to password crackers as they are easy for you to remember.

The password policies supported by YouTrack help prevent users from creating weak passwords like these:

Entropy as a Measure of Password Strength

When you set a password policy, you determine the minimum entropy for passwords created by users that log in with Hub authentication. Stronger passwords have higher entropy.

Entropy is an estimation of the number of guesses needed to find a password, measured in entropy bits. Adding one bit of entropy to a password doubles the number of guesses required.

The following table demonstrates the exponential amount of effort required by a brute-force attack to crack a password based on it's entropy.

For the online brute-force attack, you can see how dramatically strong passwords improve the security of your system. Very strong passwords take decades to crack, while the weak password is discovered in a matter of hours. If the password belongs to an account that gives the hacker access to your database, they can analyze it offline in a shorter amount of time.

A single weak password can open the door to unauthorized access. When you set higher requirements for passwords, this door is shut.

Guidelines for Creating Strong Passwords

YouTrack users can increase the strength of their passwords by following these guidelines:

• Create a password that consists of more than one word.

  Capitalization and character substitution don't make it harder to guess a password that is based on a single word that can be found in a dictionary. You can greatly increase the entropy of a password by using a string of unrelated words in an unexpected order, even without using special characters.

  When you add another word to a password that is already very strong, it can take centuries to guess.

• Add a few unpredictable substitutions to make words less recognizable, or insert a special character in the middle of the word. Change the order of the words to avoid a logical pattern.

• Include lowercase and uppercase alphabetic characters, numbers, and symbols strategically. For example, you can capitalize every fourth letter in your passphrase instead of the first letter of each word.

• Use a minimum of 12 to 14 characters.

• Avoid character repetition, keyboard patterns, dictionary words, letter or number sequences, usernames, names of relatives or pets, and biographical information.

• Avoid using information that is associated with the user of an account, for example, a birthday or anniversary.

When users set or change a password in YouTrack, the password is compared to and weighed against a database of over 30,000 common passwords, names, surnames, and popular English words. If the password contains any of these, or includes any of the problems described here, YouTrack identifies the problem and provides guidelines for creating a stronger password.

YouTrack uses the realist password strength estimation developed by zxcvbn to measure the strength of a password. You can read more about it in the related article.

Instructions

You can set a password policy for the Hub authentication module that determines the minimum password strength required for user accounts.