What infuriates me is when I attempt to login to a site with a password that doesn't conform to their password rules, the site doesn't give any indication. It would be so easy for sites to return an error "The password you entered couldn't possibly be your password because it doesn't conform with the site's rules. Here are the rules again FYI" so I can figure out what dumb workaround I had to go with to make an acceptable password.
Password Rules Are Bullshit
271–280 of 283 posts
Re: Password Rules Are Bullshit
#272Earlier quoted context omitted.
Yes and yes! Many throwaway accounts I have use some variation of the same password, because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. If I lose control of it, I'll just make a new one. (Karma doesn't pay the bills, and I don't make money from my very excellent youtube comments; someone else does.) This is why all these accounts get an email account tha…
> because I don't care if someone hacks my HN or reddit or youtube account. I don't use my real name on any of them. Så heter du inte Sverige?
Nej, är mitt riktiga namn Carl XVI Gustaf.
Re: Password Rules Are Bullshit
#273Inspired by this, just wrote a Ruby gem that handles passwords exactly how Atwood suggests. It's still a work and progress but I think it's off to a good start. Let me know what you think.
Re: Password Rules Are Bullshit
#274A problem with using emoji in passwords is the emoji special character keyboard shows your recently used emoji. Brute forcing a password using the recent emoji list certainly gives you a much smaller set to work. Also, the Chrome browser doesn't let you enter emoji directly, but you can paste them in (which show as two dots •• ).
Re: Password Rules Are Bullshit
#275I agree with almost everything but the he loses me towards the end: > I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally "aaaaaaaaaa". In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters. Isn't that exactly what you're complaining about with your arbitrary passwor…
Totally agree. If you annoy the user too much, they will not try to circumvent your rules, they will leave and find something else to do with their time. Also, the big question that's missing from the article is: who's the enemy? If the enemy are Russian genius hackers, then certainly very long passwords and maybe other measures are in order. But the enemy is not always remote. I just bought a new iPad and had to res…
For security answers I let my password manager generate a Multi Word Phrase you can easily spell out in a phone conversation. Store those in my password manager under my account. Someone told me he had to go through a converstation with Apple Support spelling out 3 random 20+ characater passwords and it was a nightmare. I immediatly switched tactic.
Regretfully Apple has an annoying bug that the dialogboxes accepts 5-word phrases, but only remember the first 32characters, 3 words or something alike. Very stressfull when you’re trying to recover a password.
Re: Password Rules Are Bullshit
#276Earlier quoted context omitted.
The real problem is that you are all on the same email provider. If we didn't have a monoculture in email providing, this would be far less of an issue.
Do you think yahoo and Gmail are the same email provider?
Enough people clearly do -- they think that all email addresses end in @gmail.com, even if they check their email at yahoo.com. Because we have an email monoculture.
Re: Password Rules Are Bullshit
#277Earlier quoted context omitted.
If you have a server running SSH, you can try the "lastb" command, which shows failed logins. Or, look in the logfile, often /var/log/secure or similar. root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00) root ssh:notty 116.31.116.44 Fri Mar 10 22:27 - 22:27 (00:00) ... My personal server has 153,246 entries from this single IP, from 1 March until now.
did you disable password authentication (to allow only ssh keys) ? If not, why ?
I occasionally use password login, when I'm not using my own computers.
Login using the root account is disabled.
Re: Password Rules Are Bullshit
#278If the salt for every user is the same, is it a good practise to check the password hash against existing's (registered) and reject a duplicated password ?
Re: Password Rules Are Bullshit
#279Earlier quoted context omitted.
Authenticator is great, but then you get the arsehole effect - every arsehole company decision maker wants you to only use their authenticator. So, I made an account on MS recently and can't use GA because "fuck you user, we won't stop until we own every facet of your digital existence" or something. That shows you where such companies rank security. [FWIW I expect the reverse situation is probably the same, this is…
Assuming MS means Microsoft then you are incorrect. You can use Google Authenticator just fine with Microsoft accounts (because I'm doing it.)
Then I apologise, it must be an information 'hiding' issue then because they clearly flagged installing their own Authenticator and I was completely ignorant of the use of GA; GA must be the most popular authenticator? Does this all mean I can use a third-party auth for both MS and Google sites or is it only MS that supports third-party authenticators?
Re: Password Rules Are Bullshit
#280The most recent post in one of the Tumblrs linked through the article goes through some of Facebook's password allowances: http://password-shaming.tumblr.com/post/157913813567/not-ent... Essentially, Facebook accepts 4 forms of the password as correct: 1) the correct password, 2) the caps-lock inverted version, 3) the correct password but with the first letter capitalized, and 4) the correct password + 1 character of…
Not a cryptographer, so this may be harebrained: Would someone who has access to all 4 hashes be more able to crack said hashes than if they only stored one? (Or would they salt each hash with a different salt to negate this?)
Yes, it would reduce the search space three-fold (the 4th mechanism uses the same stored hash as the 1st), and your suggestion of different salts would prevent that since each password variant would need a separate search. Still, the difference between looking for 3 things out of ~10^20 options vs. just 1 thing is not that big.