Where can you find a MD5 hash-to-source dictionary ?
Electronic Arts Hates Strong Passwords
21–30 of 111 posts
Re: Electronic Arts Hates Strong Passwords
#22Holy moly, that's really really hard to read agains that background.
Shameful plug for a tool I love: use Readable. It's like Readability, in that it strips all content other than the articles text and styles it to make it more readable (larger, aesthetic font), but unlike Readability (or perhaps more correctly, like Readability used to be), it's lightning fast. http://readable.tastefulwords.com/
Thanks! This is perfect, I dislike that Readability redirects you to their own server. I know they have to adapt their business model, but it's killing the usability factor.
Re: Electronic Arts Hates Strong Passwords
#23Does it matter if they're strong if all they're going to do is md5 them?
Yes, absolutely.
Although MD5 is a little on the short side and collisions can be generated for it easily, it would still be a noteworthy breakthrough for someone to produce a primary preimage for MD5.
That's what it would take for someone to find a working password for your account given your salt and MD5 hash.
In other words, there are still no known cracking tools that can do much better than dictionary or brute force against MD5, so a very strong password is still very strong and a salted SHA-1 password would be only slightly stronger.
Re: Electronic Arts Hates Strong Passwords
#24Unfortunately the silent limits of the password fields are very prevalent. I found out the hard way after I'd started to use Keepass to generate and manage my passwords. There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars. Obviously they don't even know why it matters. I think the developer j…
> I think the developer just silently presumed that no one would enter such long passwords.
But they had to make a specific decision to forbid long passwords; "lazy developer" or "silent assumption" doesn't explain the extra effort.
Re: Electronic Arts Hates Strong Passwords
#25Where can you find a MD5 hash-to-source dictionary ?
Re: Electronic Arts Hates Strong Passwords
#26Where can you find a MD5 hash-to-source dictionary ?
For the simpler passwords, google.
I'm serious, I've had to reverse-engineer projects I've inherited with pre-set administrator users, and simply googling the hashes reveals the password to be "elm", "password", or "9234" or something.
Re: Electronic Arts Hates Strong Passwords
#27Where can you find a MD5 hash-to-source dictionary ?
[deleted]
Re: Electronic Arts Hates Strong Passwords
#28The strenght(randomness), length, transfer and storage is essential. Its the product in itself here thats limited and should allow better security for its customers.
So when talking storage... go that nice looking search field in your imap interface and type "password", any results? I guess its pleasant to never feel the need to delete any mail when you can search for it. Nice collection when attackers breach due to limitations in product.
Re: Electronic Arts Hates Strong Passwords
#29I had a similar issue a couple of days ago. reddit let me set a password that was longer than what the login box would accept. I used the email password reset instead of firing up Chrome Inspector so I don't know if it would have worked had I got rid of the maxlength attribute on the input tag.
Re: Electronic Arts Hates Strong Passwords
#30Unfortunately the silent limits of the password fields are very prevalent. I found out the hard way after I'd started to use Keepass to generate and manage my passwords. There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars. Obviously they don't even know why it matters. I think the developer j…
> I think the developer just silently presumed that no one would enter such long passwords. But they had to make a specific decision to forbid long passwords; "lazy developer" or "silent assumption" doesn't explain the extra effort.
Usually something like this is just a sanity check. 16 characters is definitely a little stingy though, but I'd wager that a very small percentage of their user's ran into this limit (mostly those pre-encrypting locally like I do), so I think we're overblowing the issue a bit.
Those character restrictions are just silly and annoying though.