301–310 of 447 posts
A few years back, not too long ago, I started working on a new contract assignment at a medium size aerospace manufacturer. I show up and check in with IT department. The system administrator shows me to my desk, and hands me a post it note with my password. Well pass phrase is more like it. It was something like “sliding down the tall building”. I was quite impressed that they encouraged the use of long pass phrases…
Earlier quoted context omitted.
I do this on quite a few sites. Most of the easy ones have an easy to find onpaste event wired in the DOM and it's a simple delete. I feel like there are so few legitimate uses of onpaste and the browser should have an easy override that if I ctrl+v three times in quick succession or something like that it ignores or disables onpaste events. Alternatively, my password manager does have a decent "autotype" tool when a…
I find it easier just to select the DOM element for the field and do $0.value = "asd"; instead of finding the onpaste event.
Earlier quoted context omitted.
I'll let you explain that to my 90 year old grandma. (not that a password manager is really any better in this case)
Would it be that difficult? Leave a small one connected to her computer (I assume she always uses the same one). The web browser prompts "Now touch your security key", and the light is flashing. It's also a good defence againt phishing, as the key won't authenticate against a phishing site.
Earlier quoted context omitted.
I'm curious how you get your password from there and into a form on a website.
With secure inter-vm copy-pasting: https://www.qubes-os.org/doc/how-to-copy-and-paste-text/
The worst is when some forms set rules but prevent the user from pasting a string into the duplicate field for verification. If this is meant to prevent user error in case of a typo in the first field, then it also thwarts many of us using password managers. Somehow my browser can auto-generate and enter a password, but I can’t. That’s a work-around, but it’s irksome anyway. On another note, a more constructive metri…
So your comparison is somewhat right but only with an annoying definition of haiku and dictionary of words. However, a less good scheme should still be fine
Earlier quoted context omitted.
How to practically check for common passwords? Ideal would be to have like the most common 1/1000th of the hibp so that it's not too big for deployment in some clever structure (compressed trie? bloom filter?). I don't trust 3rd party services.
Have you heard about https://haveibeenpwned.com/Passwords ?
Earlier quoted context omitted.
Treating security questions like passwords and saving them in your password manager is correct, but make sure that your fake answers aren't autogenerated nonsense like ":s^Twd.J;3hzg=Q~". Many password reset flows involve communicating a security question over the phone, and it's easy enough for an attacker to guess "oh, it's just a bunch of random characters lol" and for the phone rep to just laugh and shrug their s…
Maybe “:s^Twd.J;3hzg=Q~ if I don’t spell it, it’s not me”?
Many people are, contrary to all pretense, mostly paid to not give any actual fucks.
Earlier quoted context omitted.
They should at least make their sign-up and login password fields have the same max length attributes...
It's even worse than that the BMC is a preconfigured part of the server not something you go to a sign up page for. It's literally the _change password functionality_ that does not warn/error on the password being too long!
My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).
Can I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)