3 ms·
One wonders how they discovered these common mistakes. The only way to do a systematic study would be to keep some un-hashed passwords around and compare.
by nn3 10y ago
One wonders how they discovered these common mistakes. The only way to do a systematic study would be to keep some un-hashed passwords around and compare.
- joatmon-snoo 10y agoMaybe a UX testing group? Could also be some keylogger thing.
- semi-extrinsic 10y agoNo, you could think up 20 different plausible "common mistakes", add fixes for those and roll out to some subset of users, and then just count the improvement rate of each fix to get the best four.
- beejiu 10y agoActually, you don't have to keep unhashed passwords around. You can just return the wrong password in a hidden field. When the form is posted, if the hidden field is set, you can do some analysis. This might involve storing some 'intermediate state' of the Levenshtein algorithm, for example, to find the shortest edit distance. You would only store that information anonymously, without storing the passwords. (I'm not saying they do this, that's just of the top of my head.) Edit: Or just keep the (wrong, correct) pairs for users where correct is in the top 20 most common passwords.