321–327 of 327 posts
Earlier quoted context omitted.
> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.
so you can paste with the menu? Because I guess they would just catch the keyboard events?
Earlier quoted context omitted.
I literally couldn't apply for an American Express card about 15 years ago because my (ISP) email address was too long. I wonder why they chose to restrict it rather than go with the standard email max length; they had to put effort in to pointlessly restrict new signups. Odd.
Back in '99 or so, there was a company called Halibut Stuff selling T-shirts at Defcon (and presumably other events) that included a free email redirect service with purchase of a shirt. So I got a shirt that said "myself@iwenttodefcon7.andalligotwas.thislousyemailaddress.com" Not too much later, I ended up working in software validation, and I broke so many login forms with that perfectly-valid address, I lost count…
Until a few years ago it was fairly commonplace for sites to reject my perfectly valid addresses just because they had more than one period (i.e., a subdomain) or in one case, ended in the .us TLD.
Earlier quoted context omitted.
I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?
It means it's shouldn't be on this list[1] for example, because it makes brute force guessing from a dictionary of common passwords easy. - Of all the password databases breached in 2016, "123456" made up 4% of them [1]. [1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...
I'm also kind of surprised not to find some variation of "sesame" on here.
Honestly, I'm past caring about upper length limits, however stupid they are. What really pisses me off is not validating on it, so my too-long password is happily accepted, and I have no idea what it is except that it's some prefix of the one I saved.
You'd think if they're fine with truncating the password on account creation, they'd also be fine with truncating it on login as well.
I think they simultaneously ignored all case but that could have been an unrelated site, memory is hazy.
Earlier quoted context omitted.
My mother (and many many women in this modern world) _goes by her maiden name_ so it's not exactly a secret. I always (politely) point this out when I'm dealing with a human at an institution who asks me for this information as part of the security process.
Even when a woman does change her last name after marriage, believing that her maiden name is somehow secret information in this day and age seems about as secure as "what street did you grow up on?", or "what was your high school mascot?". The root of the problem is believing that security questions are a good practice to begin with.
Earlier quoted context omitted.
Indeed, and the factor is about 95, which is close to 93, and that is not a coincidence, when you think about it. If you want to crack my password, and I tell you that my password is L characters long, by skipping all passwords of length In other words, telling someone the length of your password does not help them very much.
The impact of this really depends on the cost of calculating hashes, which varies based on hash algorithm. It might even be the difference between being able to ever find the hash or not. Being able to constrain the search space is the ONLY tool you can count on. If you say "No passwords less than eight characters", most passwords will be clustered around 9 or 10 characters. That's human nature. This means that your…
Well, not quite. If you allow say capital letters and numbers only (36 different characters), and you have to go through all 9 and 10 character passwords, skipping the first set of 1 to 8 character passwords saves you less than 0.1% of the work, if my rough back-of-the-envelope calculation is correct.
That was precisely what my statement was about - longer passwords are just so much better.
(Note that this assumes that the cost of computing the hash is by and large independent of the length of the password, which is a very good assumption for the lengths we are talking about here).