Viewing profile — markhemmings

Epic how quickly that XSS vulnerability was fixed. Great work guys!

My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.

I agree with and applaud the use of seriously here ;)

True, account should be disabled after x number of bad guesses. But securing against a "brute force" attack for me is more a case of cracking hashes from a db dump. It's easy to ch…

Completely agree. For example, I use two-factor authentication on all accounts that allow me to. Regarding limiting to 12 characters, the sites in question there are putting there …

It was a larger number at first, but try remembering say 10 words in a row over a long period of time; most people find that difficult. If hashing is implemented properly (i.e. is …