5 ms·
Tricking people into giving away their password (e.g: phishing) is a thing, but: - You can set a policy on password length/characters, making them hard to gues
by partycoder 9y ago
Tricking people into giving away their password (e.g: phishing) is a thing, but:
- You can set a policy on password length/characters, making them hard to guess.
- You can use SSL, and with free SSL certificates this is even simpler to achieve.
- Defense against rainbow tables can be achieved through salted hashes, as long as the salt isn't public.
While passwords are not a cure-all solution they're still a valid solution.
Another way of tricking someone to give you their password: http://bash.org/?244321 http://bash.org/?244321
- naasking 9y ago> - You can set a policy on password length/characters, making them hard to guess. And hard to remember, so users will write them down, lose or forget them, thus requiring costly and insecure password recovery mechanisms. It's not at all clear that passwords actually add any real security due to these issues.
- frereubu 9y agoWe had a panicked client ring us up one morning after their office had been broken into and computers were stolen. They'd been writing all their passwords on Post-It notes, which they then stuck to bottom of their screens.
- naasking 9y agoTerrible, but also amazing.
- kasey_junk 9y agoBut honestly better than using the same password across all services for the last 15 years, which to my way of thinking, is the norm.