Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"…encourage your users to enter stronger passwords."

nakedpassword.com

Post reply on HN
Print view View original

31–40 of 50 posts

Re: "…encourage your users to enter stronger passwords."

#31

Post by T-hawk »

giberson wrote: post #7

Personally I love it, however I will never ever be able to employ it on our company website. However, the concept of incentivizing the password entry field has inspired me. Instead of something risqué like nudity, how about offering a coupon off your first order (works for a commerce or service based site). Ie, as they type, gradually increase a % from 1 to 5 (or higher, what ever you're willing to offer). IE, a prog…

In addition to the business cost of giving away discounts, are you accounting for the business cost of increased support incidents for forgotten passwords?

(Good idea though)

Re: "…encourage your users to enter stronger passwords."

#32

Post by ryandvm »

knowtheory wrote: post #11

clothed to naked with just "1!aAA" :| What is with HN recently? I just do not understand why the uber-creep factor is out in force. Even if the image set is replaceable and you dont' have to use a naked lady, that is the default demo, and the stated objective of the site is Strong Password == Naked Lady. Aside from the blatant sexist targeting, this is trying to take advantage of entirely the wrong impulse. Associati…

> clothed to naked with just "1!aAA"

72 ^ 5 = 1,934,917,632

Good luck brute-forcing that. 5 characters is plenty secure.

Re: "…encourage your users to enter stronger passwords."

#34

Post by Almaviva »

ryandvm wrote: post #32
knowtheory wrote: post #11

clothed to naked with just "1!aAA" :| What is with HN recently? I just do not understand why the uber-creep factor is out in force. Even if the image set is replaceable and you dont' have to use a naked lady, that is the default demo, and the stated objective of the site is Strong Password == Naked Lady. Aside from the blatant sexist targeting, this is trying to take advantage of entirely the wrong impulse. Associati…

> clothed to naked with just "1!aAA" 72 ^ 5 = 1,934,917,632 Good luck brute-forcing that. 5 characters is plenty secure.

A billion isn't exactly inconceivably large in this context.

Re: "…encourage your users to enter stronger passwords."

#38

Post by pluies »

biot wrote: post #4

Aa2,; appears to be the shortest that gets the full monty.

That's probably one of the best comments to demonstrate the "engineer spirit": no quabble about the sexism claims, the quality of the pixel art, or if it's a good way to make people pick good passwords... Mere optimization.

Re: "…encourage your users to enter stronger passwords."

#39

Post by lukifer »

BoppreH wrote: post #23
knowtheory wrote: post #11

clothed to naked with just "1!aAA" :| What is with HN recently? I just do not understand why the uber-creep factor is out in force. Even if the image set is replaceable and you dont' have to use a naked lady, that is the default demo, and the stated objective of the site is Strong Password == Naked Lady. Aside from the blatant sexist targeting, this is trying to take advantage of entirely the wrong impulse. Associati…

"password" -> "This password would take 0.1 seconds to crack" "betterpassword" -> "This password would take 15 seconds to crack" "S89&;al(l_2z0Z¨" -> "This password would take 56 years to crack" Security by fear?

I love this idea. Is there an easy and accurate-ish algorithm that could generate the numbers involved?

Re: "…encourage your users to enter stronger passwords."

#40

Post by giberson »

pavel_lishin wrote: post #29
giberson wrote: post #7

Personally I love it, however I will never ever be able to employ it on our company website. However, the concept of incentivizing the password entry field has inspired me. Instead of something risqué like nudity, how about offering a coupon off your first order (works for a commerce or service based site). Ie, as they type, gradually increase a % from 1 to 5 (or higher, what ever you're willing to offer). IE, a prog…

And when your database is out in the wild, it'll let crackers know exactly which passwords to go after first, and which ones not to bother with!

What now?

You're statement is a little confusing. All our passwords are munged with encryption, they all look like hash garbage. How could they differentiate?

My only guess is that perhaps you've interpreted my comment as a database entry, rather than a UI progression--and you think that "%1 off coupon" is stored with the login table. That clearly wasn't what I was saying--thats a poor design. I'm saying simply offer a coupon code to users if their password validates certain levels of difficulty. It doesn't need to be tied to the account in anyway.

Also, I think that at the point of my database being in the wild, I'd think hackers will be less focusing on cracking a stored password and more interested in trying to restore the encrypted payment details?

Post reply on HN