301–310 of 327 posts
Earlier quoted context omitted.
Cost of calculating 10k character hash? IMO above 30 length serves no practical purpose.
To put this in perspective: The cost of calculating a 10k character hash is negligible compared to serving a modestly sized image. Still, you have a point that allowing arbitrary sized passwords to denial-of-service attacks. Still, a more reasonable limit would be 100 or 256, for example.
My favorite was "Verify password is not contained in standard dictionaries (including foreign, non-English dictionaries)." So I have to search every word that humanity has ever used??
---
Letters [required 1]:a, b, c, d, e, f, g, … x, y, z, A, B, C, D, E, F, G, … X, Y, Z – AND
Numbers [optional 1]: 0, 1, 2, 3, 4, 5, 6, 7, 8, and 9 – OR
Symbols [optional 1]:~, !, @, #, $, %, ^, &, *, (, ), -, _, =, +, [, {, ], }, \, |. ;, :, ‘, “, ,, ., , /, ?
Verify password is not contained in standard dictionaries (including foreign, non-English dictionaries).
Verify password is not the same as, or a trivial variation of the username.
If Account ID is ‘fred’, then password cannot be ‘fred’ ‘fred1’ 1fred’, ‘fr3d’, etc.
Password check should look for Account ID string in the password
Password system must support mixed case passwords (Password1 should yield a different result than password1)
Passwords will expire no later than one hundred twenty (120) consecutive days after issuance.
Products must accommodate Account ID lockout after 10 consecutive failed password login attempts.
The failed count (if currently under 10) should reset after a successful login
If the 10th consecutive failed attempt is reached, the Account must be locked out for a minimum of 24 hours
After a password expires, the user must select a new password
The password system must remember the previous 5 passwords for each user
The user may not select a new password that was one of the previous 5 passwords for that user
The user may not change their password more than 1 time per hour
---
https://developer.intuit.com/app/developer/qbo/docs/legal-ag...
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
Yup this happened to me. Apparently 10 is not a valid response to "What is the street number of the house you grew up in?". It needed to be at least 3 characters for some reason.
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
Earlier quoted context omitted.
I've lost count of how many times I had to "fix" broken sites by editing the javascript manually client side.
What's your process of editing client side JS? Is there some method to capture scripts before they load so you can make your modifications?
Often times when I'm fixing sites, there's an actual error thrown in the console, which will take you to the line in the code where the exception happens (or any line along the stack trace), so you can set a breakpoint right there and fix the code. If the code is minified, there's also a button near the bottom of the code section to reformat it./
The only tricky part is if the JS is embedded inside the html, then Chrome doesn't let you edit it, but often then, it's in the global Window namespace, so you can literally override the function by typing in the console. Hope this helps!
As a hands-on example, you can open hn.js on this page, add `alert('hello')` to vote(){}, save, then try upvoting my comment :)
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
What bugs me about security questions is when they give you questions that have subjective or time-varying answers. "What's your favorite X" is a terrible security question for me, I am not likely to remember an answer I chose 2-3 years ago
My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…
Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characters for input but mingles them when actually stores them (the backend uses AD for authentication, but the password change goes through a custom web form). And of course then logging in doesn't work at all. It took me days to figure out what was going on. I have…
Earlier quoted context omitted.
What's your process of editing client side JS? Is there some method to capture scripts before they load so you can make your modifications?
chrome does have overrides in developer tools - it supports persistent script editation. https://developers.google.com/web/updates/2018/01/devtools#o...