31–40 of 170 posts
Troy, watch out you don't open yourself up for an attack from the bad guys: They'll start sending you solicitations with ReplyTo addresses of industry honeypots, and before you know it, you'll become a known spammer and your regular outgoing emails will be routed to recipient's spam folders or maybe even dropped entirely.
I wouldn't be comfortable doing this, for one thing, we know people tend to re-use passwords. So any email/password info you collect should be treated with security like they just gave you their bank login, because some of them did. So then Troy has to report himself to his own service (haveibeenpwned).
This is wrong. You are logging their password attempts and then sharing them with the world. It doesn’t matter that you think you know they are scammers. What gives you the right to dispense vigilante justice by disclosing people’s passwords? Shame on you.
the reality is they are spammers, because spamming the poster is the only way they can end up with a reply email containing a link with a valid key to interact with this API
if they didn't send unsolicited commercial emails, there's no way they can interact with this API and get their passwords logged
I assume your starting password rules deliberately set the bar low to encourage PRs to improve it, since I can think of much more believable, infuriating, tedious ways to drag this out longer, keeping the user thinking they're always one step away from a valid password without being obviously silly. Believable, stupid requirements I've seen in the wild in the bad early days of complexity requirements. - your password…
I've seen a real site where the minimum password length was more than the maximum password length. Of course, if you know that you'll stop wasting your time. But if the error is just "your password is too short" or "your password is too long" it might take several tries to figure out it's impossible to satisfy the requirement.
Earlier quoted context omitted.
steam censors passwords. if you have 88 in your password you will fail to register
I understand the initial idea to block this known neo-Nazi short handle (8 for the letter H and 88 as HH standing for the 'Heil Hitler' salute in these circles). But how many people do I know born in 88. Or on the 8th of August? I understand that given the login is your public visible name on steam they just don't want clear neo-Nazi signifiers. Edit: Typo
Also, steam should never even see the password, they should only ever see the hash.
Earlier quoted context omitted.
> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.
ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.
Earlier quoted context omitted.
> For example, Steam has a system where if you enter too many invalid passwords, it will present you with a captcha which you can never actually solve. I call this "login gaslighting" and it's evil. Pioneered by the "do no evil" company.
ReCaptcha does a similar tactic but rather than unsolvable it's a stream of the most annoying captcha -- "select all of image until none are left". Fail one and you're back at the start. You do have the option to cycle captcha, but 9/10 times it'll be this one. Eventually you'll get locked out of captcha entirely. Anyone who has used Tor on Google has probably experienced this.
I assume your starting password rules deliberately set the bar low to encourage PRs to improve it, since I can think of much more believable, infuriating, tedious ways to drag this out longer, keeping the user thinking they're always one step away from a valid password without being obviously silly. Believable, stupid requirements I've seen in the wild in the bad early days of complexity requirements. - your password…