11–20 of 117 posts
In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use.
They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a…
If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are.
Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason.
Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.
My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-s…
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
Just sent an email to their WHOIS contacts.
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a…
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
The cynic in me says that this is a deliberate effort to grab as many passwords as possible. It sounds outlandish, but what actions of our rogue agencies haven't been?