141–150 of 184 posts
Earlier quoted context omitted.
Well for that you can probably turn off JavaScript or use the web inspector to enable paste.
I can. My wife, who I've taught to use a password manager, probably can't. And neither of these excuses a 27 character limit that strongly suggests my password is being stored unencrypted somewhere.
As others have pointed out, the use case for pasting plain text passwords is not quite clear. Maybe it would be a good idea to allow searching for hashes only, or at least hash the password in js on the client. Also, I'm genuinely curious as to why SHA-1 is used and not SHA-256. Surely the one-time additional cost of using SHA-256 would've been negligible for Troy? If at some point somebody manages to do preimage att…
Go here and type the character 'a':
Earlier quoted context omitted.
You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
sha1sum is giving different results. /tmp$ echo "p@55w0rd" | sha1sum 8633c4a8b38a8826132414d8861af7b6a8371976 - This is a different value from the one given in the blog post: "ce0b2b771f7d468c0141918daea704e0e5ad45db". The python sha-1 hexdigest comes out right, though: In [13]: import sha In [14]: sha.new('p@55w0rd').hexdigest() Out[14]: 'ce0b2b771f7d468c0141918daea704e0e5ad45db' In case anyone else has passwords th…
Many of these passwords are one or two characters in length. I think the 300 million number is inflated for publicity. Who allows a password that only has one character? Go here and type the character 'a': https://haveibeenpwned.com/
Many of these passwords are one or two characters in length. I think the 300 million number is inflated for publicity. Who allows a password that only has one character? Go here and type the character 'a': https://haveibeenpwned.com/
There are 9120 printable ASCII strings of 1-2 characters in length. Cunning, including that many to bulk out the list :)
BTW, I upvoted your comment. It made me laugh. Point granted.
Earlier quoted context omitted.
i simultaneously love and loathe programs that do this, I long for some kind of shell pipe negotiation. Most annoying trying to use "watch" or "less" and have the color work. "watch --color juju status --color", ahh. :-)
Having used isatty in some of my CLI programs to alter the behavior depending on whether STDOUT is a TTY, I see the appeal. It allows the program to do the best thing depending on how it's being invoked. However, more recently I've grown skeptical. It leads to surprises, and if a person isn't familiar with the finer details of file descriptors, they may wonder why piping a program changes its behavior. I think this e…
First, I used pwgen to generate temporary passwords for new unix users. I read the man page at that time, probably saw the mention about different behavior regarding output capabilities and thought : "nevermind, this is not my use case". Years later, when I decided to pipe it, I thought I already knew the program, and certainly not thought : "hey, let's check the man page again to see if the behavior may be altered on a pipe". Especially since I did not think it was a big deal, I was not putting that in a codebase, I just wanted to generate a random password to upload gifs or something.
And that's the interesting thing : should I have wanted to put it in a codebase, I would have read the man page again carefully.
All of this points to one conclusion : consistent defaults for end users are more important than sensible defaults for developers. You can expect developers to pay special attention, so that's ok to alter behavior for them through flags rather than detection of what stdout is plugged in.
I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?
Someone made an Chrome extension to enable password pasting again. Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
(And yeah, the "internet random" here has a github repo with the code, and the file that does this is an easily auditable 16 lines of javascript, so props to him for that. But it's still got the recently exploited attack vector that he or an attacker who takes over his account could push malicious updates to the extension, like the webdev extension from earlier this week...)
Earlier quoted context omitted.
You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
sha1sum is giving different results. /tmp$ echo "p@55w0rd" | sha1sum 8633c4a8b38a8826132414d8861af7b6a8371976 - This is a different value from the one given in the blog post: "ce0b2b771f7d468c0141918daea704e0e5ad45db". The python sha-1 hexdigest comes out right, though: In [13]: import sha In [14]: sha.new('p@55w0rd').hexdigest() Out[14]: 'ce0b2b771f7d468c0141918daea704e0e5ad45db' In case anyone else has passwords th…