3 ms·
Useful idea, but I wouldn't it be exploitable by adversaries as well (eg. knowing those constraints would be helpful for generating dictionary attacks)?
by webmaven 7y ago
Useful idea, but I wouldn't it be exploitable by adversaries as well (eg. knowing those constraints would be helpful for generating dictionary attacks)?
- oh_sigh 7y agoIf you're targeting a specific site's database for a dictionary attack, finding out and entering the specific constraints would be minimal effort. And if you're not targeting a specific site, you probably want your dictionary to be as permissive as possible so can potentially match users on all sorts of sites.
- darknoon 7y agoNo, because attackers can easily determine the constraints (assuming they are kept "secret") by signing up for an account on their own.
- ClumsyPilot 7y agogood old security by obscurity