5 ms·
Theory: as you ban a set of pins, for each pin the user wanted to enter, they will enter some similar pin that is not blocked, so the set of easy to guess pins
by antirez 7y ago
Theory: as you ban a set of pins, for each pin the user wanted to enter, they will enter some similar pin that is not blocked, so the set of easy to guess pins is just a transposition once you know the banned pins and after some study understand what are the most obvious variations users will pick.
- seisvelas 7y agoAh yes, recall the era of 'Your password must contain at least 8 characters and one numeric character'. So you can get rid of all the passwords under 8 characters when you run your dictionary attack, and put a 1 on the end of every password that doesn't already contain any (since everyone just adds the digit 1 to their normal password when that happens). Want your users to use a symbol? They will put a dot. Sigh. Shoutout to all of the people who's passwords end with 1. or .1 Time makes it worse - since all of the sites in that era had roughly the same rules about passwords, people adapted their passwords and just always used a password with dot one on every site. So the goal of protecting passwords from dictionary attacks became completely moot. I mean, it's not as bad as I make it sounds but still. And as always, relevant XKCD: https://xkcd.com/936/ https://xkcd.com/936/
- MattSayar 7y agoAs far as the XKCD comic is concerned, if a brute force hacker knows this strategy for password generation, they'd only need to brute-force four "bits" (common words) of information. Of course, "knowing that strategy" is a monumental assumption, but password managers trump both those options any day.