Need . . . public key . . . access
Password Rules
121–130 of 157 posts
Re: Password Rules
#122Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…
Yes, but security questions are designed to protect against untargeted phishing. There is little than can be done to automatically help protect against targeted spearphishing attacks against a particular person.
Re: Password Rules
#123Earlier quoted context omitted.
You don't need unhashed password storage to enforce similarity rules. Presumably, the user has to type in their current password when they set a new password. When processing that request, you have all the information you need to do the similarity check.
What about the 7 passwords prior?
I believe the 7 passwords prior aren't checked for similarity, only equality.
Re: Password Rules
#124Password Sucks
Re: Password Rules
#125Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…
create a "secure note" in LastPass to store "exact" answer to security question(s)
Re: Password Rules
#126Earlier quoted context omitted.
Ashamed to admit but I used to "hack" my classmates (girls) hotmail accounts like that when I was young. I tried to recover their password and if I didn't know the answer to their security question (I often did) I just asked... I was curious if they write something about me in their emails, never did...
I could be wrong but I think you're admitting to a felony or multiple felonies.
[deleted]
Re: Password Rules
#127Earlier quoted context omitted.
> The password must be exactly 8 characters long. This is probably the root cause of bad passwords. In the case of Average Joe, he is now having to choose something memorable which is 8 characters long. 'PassworD'
I agree that 8 isn't enough: http://www.linuxjournal.com/content/hack-and-password-cracki... http://www.linuxjournal.com/content/hack-and-password-cracki...
Being curious, how many password forms would actually munch up 8 Kanji happily?
Re: Password Rules
#128This reminds me of an anecdote from "The Codebook" from Simon Singh (highly recommended book btw.).
One of the reasons, why the British could crack the Enigma code, was that German officers introduced rules on how to use the system. For the Enigma machines they had to choose three out of five cylinders in different positions. The officers thought it would be more secure if they impose a rule "never use the same cylinder in the same position the next day".
Re: Password Rules
#129Also: quit the "security questions" thing. I can't count the number of times I've been locked out of my account because I couldn't remember the precise answer I gave to a security question. I bought a house last month, and the biggest thorn in my side throughout all of the financial arrangements was security questions (I'm not even joking). Here's a Facebook status update I posted (I had already been complaining abou…
It seems that no matter how many famous people have their accounts hacked by security questions, idiots will keep using them. Personally I always select a random question from the list and just paste my password there again.
Re: Password Rules
#130Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anyt…
Well the "not the same as last 3" rule is easy to circumvent: Just add a number at the end, password1, password2, password3...