4 ms·
I sell and install security systems as a side-gig (fell into it and its high margin/low effort sale). People demand easy to remember passwords. Ive tried to som
by pryelluw 10y ago
I sell and install security systems as a side-gig (fell into it and its high margin/low effort sale). People demand easy to remember passwords. Ive tried to somehow get them to use better passwords but they always call me to change it. I still try to get them to use a strong password, though.
- wtfishackernews 10y agoEasy passwords are better than default passwords.
- pryelluw 10y agoTrue, but not when the easy password is 12345abc. :(
- cm2187 10y agoIf there is an efficient brute force protection, 12345abc isn't that bad. The problem is if you let people try as many passwords as they want.
- pryelluw 10y agoThey do have a 5 tries limit before a 10 minute lockout.
- jMyles 10y agoIsn't that asking for DOS?
- Groxx 10y agosure, but then you know something's up, and you can go unplug it / investigate. better than allowing infinite attempts.
- kedean 10y agoI think the modern consensus is that reasonable rate-limiting is a superior option. It doesn't allow for DOS, but still prevents brute-forcing attack. You can even set things up such that too many attempts triggers a notification that something is probably wrong, but users can't be locked out of their own accounts.
- Groxx 10y ago"Allow 5 tries, then lock everyone out for 10 minutes" is a rate limiter. If you're talking about an arbitrarily complex one: either you're able to be locked out too, or a botnet allows near-arbitrary retries. A botnet of insecure cameras, perhaps. It's all a tradeoff. But a smart rate limiter is complex, and rarely necessary when you can be expected to have physical access to the device. Plus, these things haven't even managed basic security, why should we expect them to implement a good rate limiter?
- rahimnathwani 10y agoI'm curious which systems you prefer. I have an irrational aversion to paying a subscription fee, but it seems to take some effort to set up Motion or Zoneminder with recording and mobile alerting, and ease of use lags behind cloud services. Oh, and cheaper cameras support only mjpeg, which makes live viewing high-bandwidth. What software/hardware do you use?
- pryelluw 10y agoI sell commercial-level stuff. Cant remember the brand from memory. A friend who is in the security business (he works with factories and similar sized clientele) sources them for me. He is the expert. I merely sell and install it. I lack any real interest in this market and mostly easily sell them because other installers are really shady. No real marketing or sales effort. People just call me and I name the price. It pays to treat people well.