3 ms·
How long before this advice triggers someone to create a service to test passwords against a known corpus with a nice API, and, worse, people using it?
by glandium 10y ago
How long before this advice triggers someone to create a service to test passwords against a known corpus with a nice API, and, worse, people using it?
- jsjohnst 10y agoNeed to find the URL again, but this already exists. Yes, WTF indeed.
- AstralStorm 10y agoBest idea, send a password over the Internet to verify it. (sarcasm) Even with good TLS it is a stupid risk to take when you could verify locally. (Just the DoS potential not to mention compromise risk.)
- jsjohnst 10y agoYou do realize every time you login to a website you are "send[ing] a password over the internet to verify it" ;)