101–110 of 283 posts
Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?
I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…
Related, some of these sites you forget what you used and have to create a new password - and some of them do this horrible "You cannot re-use your four last passwords" thing which leaves you in this sort of permanent "I'm never going to remember and always have to come up with something new" loop (for sites you go to only periodically, e.g. an HR portal, let's say). But hey, nothing important lives in an HR portal,…
Can anyone explain why all authentication systems don't enforce a (say) 2-second delay on repeated password attempts? Wouldn't this solve nearly all insufficient entropy problems? Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?
Luckily, there's out-of-the-box solutions that are easy to set up, e.g. Fail2ban.
Fail2ban scans your server logs, spots repeat login attempts, and sets up a temporary iptables ban on their IP.
Can anyone explain why all authentication systems don't enforce a (say) 2-second delay on repeated password attempts? Wouldn't this solve nearly all insufficient entropy problems? Even a 5-character password should suffice in this situation, and a human user would never even notice the 2-second delay. How would malevolent password-crackers get around this?
Also anyone who swipes the server's DB would have an easier time cracking the hashes, even if you use bcrypt/scrypt.
Earlier quoted context omitted.
> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…
> Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt. I wonder why people are so eager to combine different hash algorithms, especially a strong with a weaker one. If this is isn't a well-established anti-pattern, it should become one.[1] Why? Because in some sense it combines the weaknesses of both algorithms. Assume your password hash is: h(p) = bcryp…
Is password hacking really still that big of a deal? I mean, most big hacks into retail places like Target, Best Buy and others are done by getting into their POS (point of sale) systems, or hacking their networks to get at the customer data.
I just don't see a lot of one off doxxing to get into a persons email or financial records. Most groups are going after the big scores, not small potatoes stuff like a few hundred cracked password protected accounts.
I could be wrong, but it just seems like even when you protect your accounts with a strong password and triple layer redundancy and six-step protection, all it takes is one SQL injection or an Adobe Flash flaw and all that work is useless because the company holding your information was lax with their own security.
I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…
"There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with an overly creative password." Indeed and then one's email potentially becomes the weakest link in one's password security.
Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…
I thought they were locking me out for proxying or something until eventually by luck I noticed what was going on.
I'm surprised that this article didn't mention the most important point about password rules: They force you to come up with a new password that you probably haven't used before and so you will probably forget it. There are websites that I don't use often where I literally have to reset the password (and go through all the i-forgot-my-password steps) every time I want to log in because they forced me to come up with…
Best to just use a password manager and keep unique per-site passwords.
I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…
There's no substitute for length. "dog" is a bad password. "doooooooooooooooog" is much better. The entropy is still the same, but the latter takes much longer to brute force and is just as easy to remember.
Of course one should not use passwords one can remember for anything critical, but many passwords are for services where compromise is not a big deal.