141–150 of 327 posts
TreasuryDirect, an official US government site for buying and selling Treasury securities, makes users enter their passwords via a clickable on-screen keyboard. The passwords are not case-sensitive either.
FYI, you can just open up the html inspector and delete the readonly = "readonly" on the input box and suddenly you can use a password manager to fill it in.
Earlier quoted context omitted.
I don't even think rate limiting after 3 mis-attempts makes sense. I regularly can't remember my password and might need 6 attempts. Nobody's going to guess your password after 300 attempts, so make the limit 30 and you're safe.
This is basically why I started using a password manager. Screw up 1 too many times and you end up in a cycle where you never will remember your password and you'll try the last 3 or 4 you used, eventually locking yourself out again.
Also, TLS is MITM-able (the CA system is one giant backdoor, CT doesn't prevent MITM attacks) so you're password and authenticated token can be captured and your account can be pwnd.
Don't use pass words. Use mnemonics to derive public/private keys and use authenticated encryption (see lib sodium) or separate signatures and encryption.
Some of my explorations here (work in progress)
https://docs.google.com/presentation/d/1f2k6fsIkDmIS1WyJAT0l...
Passwords, on average, have around 40 bits of entropy (or 0 if they're in any existing list, and some lists are 500M strong) so don't us pass words. Also, TLS is MITM-able (the CA system is one giant backdoor, CT doesn't prevent MITM attacks) so you're password and authenticated token can be captured and your account can be pwnd. Don't use pass words. Use mnemonics to derive public/private keys and use authenticated…
If you choose a password by randomly selecting from a list of 500M passwords, surely it has log_2(500,000,000) ~= 29 bits of entropy?
> Password must be exactly 6 characters long and no special character.
I had an account with these guys. Their security is just ridiculous. 6 alphanumeric characters is all they'll accept! I mean, some of the entries on the list are bad, but this is a friggin major national bank in Canada with a piss-poor password requirement.
This list needs to be segregated into different categories so we can laugh at the different ways sites are dumb.
EDIT: OK, they apparently updated their password rules to make them more sane (but didn't, like, tell any of their clients to go update their passwords?). Apparently their previous system was worse than I thought - it actually mapped your alphabetic password onto a number pad, so if you set the password AbcDEf then you could login with 111222. Guess this is what happens when you try to drag a telephone-banking system into the online banking era...
My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…
I kept thinking there was probably something in their tos pushing the blame on me if any issue happened since I had to bypass their security feature.
Earlier quoted context omitted.
Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.
I haven't checked lately, but I understood that Facebook passwords are case-insensitive.
Stackoverflow Meta Question here:
https://webapps.stackexchange.com/questions/26301/facebook-a...
My Question (the reason why I know):
https://stackoverflow.com/questions/10718236/how-to-alter-th...