6 ms·
You've just described phishing.
by ilikebits 10y ago
You've just described phishing.
- markcerqueira 10y agoWouldn't phishing be more like "make a site that looks like Facebook and try to get people to input their Facebook passwords?" What this person described is more abusing password recycling no?
- newjersey 10y agoIt doesn't even have to be recycling. In fact, I have incorrectly pasted a wrong password to my Google account not realizing I had copied from one row underneath. Personally, I place a lot of faith and trust in Google so I don't think they'd store failed password attempts about me (I've already volunteered them more information about me than I would volunteer to my own elected representatives anyway). If I ever realized I made a mistake the other way round, I'd reset the password to my Google account even though it has 2FA.
- leesalminen 10y agoHave you ever noticed that if you enter a password previously used on a Google account it will tell you "password changed X units of time ago"? That surprised me. It wouldn't surprise me if they're storing failed attempts at all. More data to feed the machines.
- deleted 10y ago[deleted]
- jlgaddis 10y agoEvery Linux machine knows when you last changed your password, too. $ passwd --status
- emmelaich 10y agoOnly root can do that.
- Dylan16807 10y agoI'm not sure why that would matter, but that's not true. No sudo needed to look up that I set my password on this VM on 2013-10-08.
- emmelaich 10y agoThat was a direct copy'n'paste from a session on centos7. Password age is kept in /etc/shadow, not /etc/passwd. So the passwd command is (needs to be) setuid. Redhat generally limits what setuid programs can do. Probably sensible.