5 ms·
No amount of salting is going to make a 3-character recognizer secure.
by Strilanc 10y ago
No amount of salting is going to make a 3-character recognizer secure.
- wlievens 10y agoThe 1, 6, 7 is random
- Retr0spectrum 10y agoThat's irrelevant.
- yk 10y agoThe problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.
- OJFord 10y agoBut three strikes and your out - out to the physical bank with proof of ID to change it.
- MereInterest 10y agoYou're assuming that the verification is being done by the bank itself. This is under the assumption that there has already been a security breach. The password database has been stolen, and has just been sold to the highest bidder. In that case, there is no lockout.
- coldcode 10y agoNot if they steal the database. No matter how you limit the external access you also have to protect against people with unlimited time with a copy.
- ATsch 10y agoThat is nice and all, but the scenario we are talking about is a db compromise, in which case any rate-limiting is circumvented.
- Dylan16807 10y agoThat defense also works for plaintext passwords. Tell me why plaintext password storage is bad, and you'll defeat your own argument.