Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NULL license plate not such a bright idea

knrs.iheart.com

Post reply on HN
Print view View original

441–450 of 484 posts

Re: NULL license plate not such a bright idea

#441

Post by im3w1l »

repolfx wrote: post #315
_bxg1 wrote: post #302

I recently bought a *.ninja domain name and started using it for my personal email address. Probably 20% of the time, when I try to sign up for a service it gets rejected by web forms that have been hardcoded to check for traditional top-level domains.

Oh you think that's bad? My email address ends in that most exotic of domains, .net I find websites that won't accept it because they think it's an invalid address all the time. I have no idea what logic they're using, would love to find out.

Interesting. I have a country topdomain email and never had problems.

Re: NULL license plate not such a bright idea

#442

Post by efreak »

marktangotango wrote: post #325
jtc331 wrote: post #303

Earlier quoted context omitted.

Wells Fargo’s is 12 IIRC.

Lots and lots of legacy systems do this, very low limit, case insensitive, numbers and letters only. I know of a major retailer with 10 character, case insensitive, alpha numeric for All their systems. Why? Because that’s the lowest common denominator (as400).

That's how my dentist's billing website works. Except it's limited to 8 alphanumeric characters, not 10, and they were quite happy to accept my pasting a 16-character generated password into the field. Unfortunately, they don't have a password reset link; instead, the you call the receptionist and they read out your password to you over the phone. This isn't a legacy system, either. I can only imagine the backend is written in QBasic or something.

Re: NULL license plate not such a bright idea

#443

Post by daemin »

luc4sdreyer wrote: post #298
dajonker wrote: post #250

Earlier quoted context omitted.

Yes, this is terribly annoying, often there is a minimum length but no mention of maximum length. I see this on many, many websites...

What kind of range limits are you talking about? 30? 100?

I've seen 6 characters and 16.

Re: NULL license plate not such a bright idea

#444

Post by efreak »

mbuinl989 wrote: post #356
kevinmchugh wrote: post #242

Earlier quoted context omitted.

Special characters in passwords were highly recommended when rainbow tables were an effective way to attack password hashes. See this old Coding Horror blogpost for an idea what it was like at the time: https://blog.codinghorror.com/rainbow-hash-cracking/ Salted hashes have made rainbow tables less effective. Password managers have made single-use passwords more tenable. Not knowing how a system will store my passwor…

Password Managers are the new goto for obtaining all passwords and web browser zero days make it very easy to lift and then use for a variety of purposes. A simple lined small note book is good, but made secure is best, yet how would you make a pwd note book secure from someone else? This even applies to devices like bank cards and other things which needs a security code of sorts.

Keep your password manager offline with Keepass2 USB keyboard plugin for Keepass2Android [1], but I'm not sure how well it works. Too-fast USB keyboard input does seem to have issues (the open issue seems similar to things I've seen an AlphaSmart 2000/3000 do in USB emulation mode; PS/2 always worked fine).

There's also this other project, which seems more generic/difficult [2]

1: https://github.com/whs/K2AUSBKeyboard 2: https://github.com/pelya/android-keyboard-gadget

Re: NULL license plate not such a bright idea

#445

Post by efreak »

MaxBarraclough wrote: post #299
EliRivers wrote: post #9

Related, for those who missed it the last time it was here on HN, the tales of Christopher Null, who has an unfortunate surname: https://www.wired.com/2015/11/null/ , and Jennifer Null , http://www.bbc.com/future/story/20160325-the-names-that-brea... , likewise.

Much-needed Outline.com of the wired.com article: https://outline.com/WMzjYK

It seems meaningful to me that the wired website works (sort of; the left margin is 1/3 of my screen) with JavaScript disabled, and outline doesn't work at all.

Re: NULL license plate not such a bright idea

#446

Post by rypskar »

luc4sdreyer wrote: post #298
dajonker wrote: post #250

Earlier quoted context omitted.

Yes, this is terribly annoying, often there is a minimum length but no mention of maximum length. I see this on many, many websites...

What kind of range limits are you talking about? 30? 100?

Lots of sites have a limit of 72 characters, maybe even without the developers knowing about it. Bcrypt has a limit of 72

Re: NULL license plate not such a bright idea

#447

Post by kalleboo »

hn_throwaway_99 wrote: post #90

Tangentially related somewhat-common bug: YAML files will interpret the literal 'no' as boolean false if it's not quoted, instead of as a string. Many developers have wondered why, when they stuck country-specific configurations in a YAML file, that things suddenly stopped working when they expanded support for Norway.

I remember a story when Microsoft translated some ancient version of Internet Explorer for Mac, there was a menu where you could select TLDs (I can't remember what for) and the .no domain ended up getting translated as the word

Re: NULL license plate not such a bright idea

#448

Post by deadbunny »

Dextro wrote: post #434
luc4sdreyer wrote: post #298

Earlier quoted context omitted.

What kind of range limits are you talking about? 30? 100?

I remember that Microsoft got stuck with a 16 character limit for a while thanks to hotmail.

"for a while"

You mean until May of 2019?

https://techcommunity.microsoft.com/t5/Azure-Active-Director...

Re: NULL license plate not such a bright idea

#449

Post by dredmorbius »

foxylad wrote: post #406
mbuinl989 wrote: post #356

Earlier quoted context omitted.

Password Managers are the new goto for obtaining all passwords and web browser zero days make it very easy to lift and then use for a variety of purposes. A simple lined small note book is good, but made secure is best, yet how would you make a pwd note book secure from someone else? This even applies to devices like bank cards and other things which needs a security code of sorts.

Make the passwords one character longer than what is noted in the book? Only you know the character and where it is added. For bank cards with fixed lengths, increment/decrement the nth character, swap two characters, or do a circular shift.

Or an arbitrary number of characters. If you know the additional six alphanumeric characters added, that's another 14 million combinations to test.

Or 2FA, or ....

Re: NULL license plate not such a bright idea

#450

Post by dredmorbius »

mehrdadn wrote: post #337
monocasa wrote: post #221

Earlier quoted context omitted.

That's absolutely how bits of entropy work.

That's most definitely not how security works. The strength of your password is not proportional to the number of bits of entropy it has.

The way you're phrasing this may be misleading.

The strength of a password / passphrase increases with the power of 2 raised to the bits of entropy.

That's an exponential proportion, rather than a linear one. But a proportion all the same.

Example:

Given mixed-case alphanumeric (62 characters) and an 8-character password length, the number of combinations is:

    62^8 = 218,340,105,584,896 (keyspace -- 218 quadrillion)
    l(62^8)/l(2) = 47.6 (bits of entropy)
A 10 character password (if randomly chosen from the same character set) has 10^17 possibly combinations (about 4,000x more), and 59.4 bits of entropy, 11.8 bits more. 2^11 = 2048.
Post reply on HN