5 ms·
What exactly does this hurt? It cuts down on customer-support traffic, makes life easier for the user, and (as far as I can imagine at least) doesn't make anyo
by CamperBob 16y ago
What exactly does this hurt? It cuts down on customer-support traffic, makes life easier for the user, and (as far as I can imagine at least) doesn't make anyone any more vulnerable. Under a fuzzy comparison scheme, weak passwords are still weak, and strong passwords will still be strong.
- RickHull 16y ago> strong passwords will still be strong. I think you meant: strong passwords will be truncated down to 8 chars, making them weak.
- kgermino 16y agoTo be fair almost any password is weak if it hasn't been changed in several years.
- jemfinch 16y agoStrong, 8-character passwords are 1 in 5132188731375616. Is that really so weak?
- nbpoole 16y agoThat depends on how fast you can check for validity. See http://news.ycombinator.com/item?id=2003888 http://news.ycombinator.com/item?id=2003888 or http://news.ycombinator.com/item?id=1545576 http://news.ycombinator.com/item?id=1545576 for examples of how fast certain types of brute-force attacks have become.
- jackowayed 16y agoA strong password that gets a lot of its strength from length and mixed case will not still be strong under this error. For example, the password fOoBaRbAzbArBaZFoO would be a pretty strong password. foobarba is much weaker, and this error would make foobarba (and foobarbaz, etc) work.
- CamperBob 16y agoA strong password like that is written down on a Post-It note on the user's monitor, and hence is not very strong at all.
- nialo 16y agoA password of that sort is both not that hard to remember and probably fine on a post-it not on the monitor of your home computer. There's really not much overlap between the sorts of people who will break passwords and who will be in a position to read things on your monitor. (and if they can, some browser password auto-save feature is going to screw you anyway so it doesn't matter)