When it comes to composition and length, passwords mostly don't matter

Post by dev_dull » Fri, Jul 12, 2019, 4:40 AM UTC

rkagerer wrote: post #83

If you are using a password manager, use the maximum possible length – there’s no usability downside if you are already cutting and pasting. That's fine and dandy until you need to manually type it in somewhere (e.g. reading it from your phone, typing it in on another device). Has this guy ever even used a password manager? He understands how they work in theory, but in practice it's not always quite so clean. Humans…

Post by shalmanese » Fri, Jul 12, 2019, 4:42 AM UTC

neotek wrote: post #58

q_queue wrote: post #18

Earlier quoted context omitted.

Furthermore many sites make it difficult to use a password manager because it's hard to block automated password guessers and not interfere with password managers trying to enter passwords.

My old bank used to "encrypt" your password as you typed it into the input field, on keydown it would take the character you typed and — and I'm not making this up — ROT13 it . This had the effect of making it impossible to paste anything into the input field since the script would capture your ctrl+v and replace it with the letter "i". The icing on the cake is that when I called to complain about it, the support age…

Post by dev_dull » Fri, Jul 12, 2019, 4:48 AM UTC

function_seven wrote: post #98

sxates wrote: post #86

Earlier quoted context omitted.

The best is typing that 20 character mixed-case-plus-numbers-and-symbols password for Netflix into your TV app using an on screen keyboard and directional arrows...

This is a huge benefit of AppleTV and having an iOS device. When the password is prompted for on the TV, my phone buzzes and I use the LastPass vault on the phone to paste the gibberish automatically. I'm sure there are similar schemes for other devices (Chromecast/FireTV?). But when the TV itself is "smart", I bet it's infuriating.

Post by aianus » Fri, Jul 12, 2019, 4:59 AM UTC

senectus1 wrote: post #51

simonebrunozzi wrote: post #34

Earlier quoted context omitted.

> No SMS text option. ... ridicolous Agreed. My Twitter account was recently hacked thanks to T-Mobile's incompetence. [0] [0]: https://medium.com/@simon/mobile-twitter-hacked-please-help-...

I'm confused... because the whole reason your twitter was able to be hacked was because the SMS option allowed it to be hacked.. They stole your SIM. SMS option was now in their control. SMS is not a secure 2FA option. sure its better than not having 2FA but only a little better.

Post by gpm » Fri, Jul 12, 2019, 5:02 AM UTC

gruez wrote: post #75

gpm wrote: post #33

Earlier quoted context omitted.

This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. You'd probably mostly catch password managers and people copy-pasting passwords though. If you had per-user fingerprints also people typing on a new device...

>This is giving me bad ideas about making the UI (and only way to log in) be to send the password 1 character at a time as it's typed, and then using some form of ml to try and identify probable bots. at that point you might as well outsource that sort of fingerprinting/behavior analysis to some service like recaptcha.