251–260 of 278 posts
Earlier quoted context omitted.
You're really grilling someone for not fetching salts in psuedocode?
It's not about fetching salts, it's about the whole approach; you literally can't approach it that manner.
Given the forum I too would have believed that to a reasonable assumption, but this thread shows it may not have been.
Earlier quoted context omitted.
I thought the same, and was surprised to find the problem here seems to be that there's no part of the HTML spec to set the allowable characters in a text input. So JavaScript to intercept keypresses or postprocess the string is risky at best and often poorly implemented. If it was in HTML it could be reliable, and have a unified behaviour when text is pasted in. For phone numbers there is a "tel" input, so the undes…
Doesn't the HTML input `pattern` attribute help solve this with a RegEx?
Earlier quoted context omitted.
Realistically this is only going to affect people on mobile devices, which looks like it'd bring that down to about 6.5%
With over 1.5 billion active users... 6.5% is still a very large number of people! Also.. not sure what safari/iOS did in their early years with keyboard password entry capitalization... but if they did auto capitalize... since Apple is so good at saving profile info across new installs/os updates... I imagine there would be a large portion of old apple users with perma-capitalized passwords out there as well.
Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…
if your pw was "abcd", then "Abcd" should work, right? Because it auto-capitalizes the first character of the first word. If your pw was "ABCD", then "abcd" (all-small) should be accepted because it auto-capitalizes and then you press the capital key once for caps, so it becomes all small. Did I get anything wrong?
1: https://pics.me.me/caps-lock-cruise-control-for-cool-image-5...
Probably a feature, not a bug. Most mobile keyboards automatically capitalize the first character by default. With the ephemeral nature of password characters upon entry; it would be easy to miss the capitalization, annoying users. This one small trick probably prevents millions of people from becoming frustrated with Google every single day. And I'll bet it only works one way. If your password was "ABCD", then by my…
This doesn’t seem particularly alarming. Googles account security is above and beyond the rest of the web right now. I doubt a single attack has been made realistic by this feature.
Earlier quoted context omitted.
They might do the same stupid thing Gmail does, and ignore certain characters. My Gmail is "first.m.last@gmail.com", but I constantly get mail from idiots who don't know their own email address, and use my "firstmlast@gmail.com" to sign up for things. This problem would go away entirely if Gmail didn't do this. Facebook might do similar things to make it "easier" to login, even though there are security implications.
That’s by design though, the .‘s are optional. You can add more even. Also plus routing: first.m.last+whatever@gmail.com also routes to the same email.
This doesn’t seem particularly alarming. Googles account security is above and beyond the rest of the web right now. I doubt a single attack has been made realistic by this feature.
Their account security is so good, I'm not able to log in to my own account even when I know the exact username/password, and I hate it.
Earlier quoted context omitted.
Unless it has been edited since i saw it, the pseudo sql doesn’t select anything, a logical assumption is user identity and not needed. The comparison is between the original hashed password and the hashes made at auth-time. The name of the original is “pass” but since it wouldn’t make sense to compare a plaintext string to a hash another logical assumption is that “pass” is a hash. Maybe these generous assumptions a…
Jeebus, it's just meant to show that you could do a select in one go without having to do them one at a time cascading to the next one if no match. I don't know what you need to select, that's up to the reader. That's the point of psuedo code. You saw select and made the connection to "it's a database query". Boom. point made. Again, I understand the concept of user provided pass and a hash with a salt. If you can't…
It’s not the select that’s the problem, it’s the clause, so your explanation also seems to imply that misunderstanding on your part is real.
