191–200 of 283 posts
Earlier quoted context omitted.
> I am being serious when I ask this question: does anybody brute force passwords? Very many people. And not all systems stop them from doing so. And database leaks happen all the time too...
It wouldn't really matter how good your password was in the leak/breach scenario would it?
Earlier quoted context omitted.
> if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing You do. A lot of users don't consider automation when it comes to people hacking their account. I've heard "Nobody will ever guess it though" a few times during my career.
I am being serious when I ask this question: does anybody brute force passwords? I posit that using a unique password for every single website is sufficient, because no one brute forces passwords. What attack vector is a password with high entropy protecting against? The only one I can think of is an unreported database leak. The attacker may be able to more easily reverse the password hash and use your account on th…
There's a difference between random script kiddies and targeted attacks. People do all sorts of wacky things.
They are merely the only thing we know how to do which meets the expected constraints on auth. I can't even give them a grudging 'least bad option' because they're so bad, in our current context and multiplicity of identities.
They are so unmanageable for normal humans we have a bunch of helpers, which become the new single point of failure.
Yubi dongles on a keychain may well be where we're headed.
"Wouldnt it be better, the admins switched to better more learned users and dissolved the company to have the provlem get root."
Here's another problem that isn't discussed very much: error messaging and failure modes. I use a command line tool to generate passwords, and I use a password database to store them. It has happened to me before that the maximum password length is something disconcertingly small, like 20 characters. I would copy and paste my password, submit, and then failed to be able to login. Why? Because my password in the "crea…
Earlier quoted context omitted.
> I am being serious when I ask this question: does anybody brute force passwords? Very many people. And not all systems stop them from doing so. And database leaks happen all the time too...
It wouldn't really matter how good your password was in the leak/breach scenario would it?
Earlier quoted context omitted.
> I mean, I can imagine that a clueless user might have the illusion of safety if they're using something like "1q2w3e4r5t" but if I use "aaaaaaaaa" as a password on a website I know full well what I'm doing. So why even bother? It's not an illusion, 1q2w3e4r5t is indeed better than aaaaaaaaa, even if it's just the numbers interleaved with qwerty (and probably easy to brute force generate up to it). > if I use "aaaaa…
Okay, I'm game: HHHnHHHHnHHHHHnnnnnnnnnHHnnnnnnHHHHH It's a password that I postulate is more secure that the average and yet is only made of two different symbols and would've been rejected by the proposed "x amongst y" character policy. It's a bit far fetched but not that much, you'll notice that the pattern is simply the first digits of pi, so it's fairly easy to remember. And the letters are "Hn", like hacker new…
Only they don't need to know how YOU generate your passwords. Just how most of their users generate their passwords. The suggestions and rules are not there to protect computer scientists from entering bad passwords...
Earlier quoted context omitted.
> Why? Because my password in the "create" page was silently truncated on the front end, but the same truncation does not occur in all places, so I would type a longer password on the login page then what was registered in the system and it would fail. Here's an even worse one than truncating the end of long passwords: truncating internal whitespace The change/reset password dialog for Apple ID does this. If your pas…
> Also you can work around that by hashing the entire uses password (with say SHA-512) prior to inputting into bcrypt. I wonder why people are so eager to combine different hash algorithms, especially a strong with a weaker one. If this is isn't a well-established anti-pattern, it should become one.[1] Why? Because in some sense it combines the weaknesses of both algorithms. Assume your password hash is: h(p) = bcryp…
People are eager to combine different hash algorithms frequently because they desire to hedge against weaknesses in one of the algorithms. Or, in this case, because they want to shore up an existing 'weakness' in one of the algorithms (for bcrypt, its maximum input size).
You are correct that doing this ad-hoc should be an 'anti-pattern'. There are subtle details (see the papers linked above...). However, the idea itself is sound, if handled properly.
Earlier quoted context omitted.
'legit users' There isn't a day that goes by that I don't get an email intended for someone else, often including personal information, due to a mistyped email address. Whoever decided that email verification was a poor user experience needs to be hit in the head with a shovel after he digs the appropriate sized hole. If you know Catherin (PA) let her know her round trip to vegas is confirmed Carolyn's (NYC) open tab…
As someone with an unusual name (used for my public-facing email address) and who uses a fairly unusual email for personal stuff... that's pretty different from my experiences. I've never ended up with someone else's mail at all. That's a solid argument for business cards with vCard QR codes as I see it. Or a pack of stickers with QR codes that you could slap on whatever documents you needed. It's too bad QR code ado…
I think it's more likely if you use an initial in your email address. I have a fairly unusual last name, but I used my first initial to create my gmail address, so I regularly get stuff meant for a couple of other people.
Business cards or sheets of stickers are not going to solve this problem. The former is not universal, and you're not going to get enough adoption for the latter (do you really want to carry them around in case you need to put your email on a form?).
The only solution that might actually work is to put some kind of financial penalty on certain classes of email sender to incentivize reasonable levels of validation.