21–30 of 134 posts
FJFJFJFJ takes "centuries"? Probably needs a little more tweaking.
A fun extension would be to recognize repeated chunks in addition to single characters.
Earlier quoted context omitted.
Did hindi take "guess" as a loanword or is that just a massive coincidence
Loan word. I can't remember the the Hindi word for "guess" right now. PS: Although I don't remember the exact words but there were some which are strikingly similar in both languages. But I found this for you. http://en.wikipedia.org/wiki/List_of_English_words_of_Hindi_...
Bujho.
FJFJFJFJ takes "centuries"? Probably needs a little more tweaking.
It certainly needs more tweaking. FJ, FJFJ, etc isn't in any of the 10k passwords people commonly use, isn't a sequence, isn't a single repeated character, etc, so zxcvbn recognizes it as bruteforce. A fun extension would be to recognize repeated chunks in addition to single characters.
> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?
name=drostie&password=wining%20%26%20dining%20the%20suckas!&language=en-US
The exclamation mark is weirder -- I can't think of a deep need to escape that symbol. The + symbol, maybe, since sometimes + in a URL is supposed to be used as a replacement for %20 as an encoding for a space, but not the ! symbol.
I hate when they won't let me use a password that's not "strong" enough. I picked my password, let me use it. I know the consequences of using an easy password.
I hate when they won't let me use a password that's too strong. Nothing makes less sense to me than rejecting a password because it contains '!' or '#'.
Earlier quoted context omitted.
A not-very-great but traditional way to avoid some kinds of security holes is to sanitize your input by blacklisting anything that could be a shell/scripting/SQL metacharacter. Seems restrictions like that are still pretty common, either because it's actually still needed for security (alarming if true at BoA), or because it's now a sort of cargo-cult thing.
sounds about right. screenshot of BofA's policy here: http://dl.dropbox.com/u/209/bofa_password_constraints.png the forbidden list is: $ ^ ! [ ]
Looks unbelievable at first. How could people be so stupid?
But I use such passwords all the time. I use a variety of websites where I have no need or desire for security. Want to post burrito reviews on burritophile.com as me? I picked something simple and easy to guess, a couple hours and you'll be going to town! (Just promise not to badmouth the Cosmic Cantina.)
My bank accounts? Oops, didn't use the same password.
I wonder if that's because email addresses are really hard to crack or if it's because the rules of this scoring system weren't designed to account for such a practice. Not a practice of using your real email address as a password, but the practice of using a fictional email address as a password.
> Bank of America doesn’t allow passwords over 20 characters, disallowing correcthorsebatterystaple. Passwords can contain some symbols, but not & or !, disallowing the other two passwords Can anyone elaborate why "&" or "!" wouldn't be allowed?