6 ms·

clothed to naked with just "1!aAA" :| What is with HN recently? I just do not understand why the uber-creep factor is out in force. Even if the image set is

clothed to naked with just "1!aAA" :| What is with HN recently? I just do not understand why the uber-creep factor is out in force. Even if the image set is replaceable and you dont' have to use a naked lady, that is the default demo, and the stated objective of the site is Strong Password == Naked Lady. Aside from the blatant sexist targeting, this is trying to take advantage of entirely the wrong impulse. Associating a strong password with the human drive for porn doesn't actually encourage any better understanding of strong passwords or why they should be used. If this were to be something like 'pwnyourpassword', and demonstrate how easy it'd be to crack your password w/ a dictionary attack, then this wouldn't be either as exploitative or crass. Instead, the mechanism is, lets distribute pixel art of naked ladies to incentivize instead of teaching/demonstrating. Yeah, that's the society i want to live in. :|

deleted 16y ago
[deleted]
there 16y ago
What is with HN recently? I just do not understand why the uber-creep factor is out in force. and yet: clothed to naked with just "1!aAA" :| so you clearly spent some time trying to get it to display the naked lady even after you knew what it was. creep.
- knowtheory 16y ago
  /me laughs Oh yes, there's a lovely false equivalency. Figuring out what the mechanism for identifying strong passwords is != coding and posting the tool above.
- deleted 16y ago
  [deleted]
petercooper 16y ago
Instead, the mechanism is, lets distribute pixel art of naked ladies to incentivize instead of teaching/demonstrating. Do you take offense at the fake "flies" they stick into urinals to focus men's attention? I suspect the "naked lady" (which looks nothing like the real deal - I know, I have a kid) isn't so much the point here as the ability of a changing graphic to play the role of the aforementioned fly. I prefer the "discounts" idea raised elsewhere in the thread though.. a discount's more use to me than a heavily pixellated "babe" ;-)
BoppreH 16y ago
"password" -> "This password would take 0.1 seconds to crack" "betterpassword" -> "This password would take 15 seconds to crack" "S89&;al(l_2z0Z¨" -> "This password would take 56 years to crack" Security by fear?
- lukifer 16y ago
  I love this idea. Is there an easy and accurate-ish algorithm that could generate the numbers involved?
  - mcarlin 16y ago
    Meh, this probably encourages people to distrust your website.
    - BoppreH 16y ago
      Excellent insight. Looking back, people would clearly avoid sites that tell them how insecure their accounts are, even if it's for a feel good measure.
  - BoppreH 16y ago
    Estimating time with dictionary attacks would be hard because, well, you have to have a dictionary at hand to see how far down the list the word is. Personally, I would make a list of the top 1k or 10k most common passwords and assign a very low number to them. Say, a few seconds max. For any password that is not on the list, get the subset of characters used (upper+lower case, lower case+numbers, symbols+numbers, etc); raise it to the power of the password length to get number of possibilities; multiply by a random number (<= 100) and divide it by the FLOPS of a retail computer. Don't forget to display it at the nearest time unit (seconds, weeks, years). Absolutely naive and a bit too rough around the edges, but good enough to send the message.
wonderzombie 16y ago
Agreed. This is extra creepy. Flagged.
ryandvm 16y ago
> clothed to naked with just "1!aAA" 72 ^ 5 = 1,934,917,632 Good luck brute-forcing that. 5 characters is plenty secure.
- Almaviva 16y ago
  A billion isn't exactly inconceivably large in this context.
drdaeman 16y ago
Tthey do not measure entropy (very good point about measuring entropy here: http://codereview.stackexchange.com/questions/868/calculating-entropy-of-a-string/878#878 http://codereview.stackexchange.com/questions/868/calculatin...), but just check that password conforms to several simple rules. So, yes, "2tcUKstR" (which I've just generated with `openssl rand -base64 6`) is considered less secure than "Aa1!!". Well, the good thing that they're just suggesting about password's quality, not enforcing it. It really pissed me off when one site declined to accept password and said it was "insecure" just because I was using base64, and (by chance) password did not contain any non-alphanumeric characters. I've also seen another site which rejected "/" in passwords, insisting on /^[A-Za-z0-9]$/ only.

deleted 16y ago

[deleted]

there 16y ago

What is with HN recently? I just do not understand why the uber-creep factor is out in force. and yet: clothed to naked with just "1!aAA" :| so you clearly spent some time trying to get it to display the naked lady even after you knew what it was. creep.

knowtheory 16y ago
/me laughs Oh yes, there's a lovely false equivalency. Figuring out what the mechanism for identifying strong passwords is != coding and posting the tool above.
deleted 16y ago
[deleted]

petercooper 16y ago

Instead, the mechanism is, lets distribute pixel art of naked ladies to incentivize instead of teaching/demonstrating. Do you take offense at the fake "flies" they stick into urinals to focus men's attention? I suspect the "naked lady" (which looks nothing like the real deal - I know, I have a kid) isn't so much the point here as the ability of a changing graphic to play the role of the aforementioned fly. I prefer the "discounts" idea raised elsewhere in the thread though.. a discount's more use to me than a heavily pixellated "babe" ;-)

BoppreH 16y ago

"password" -> "This password would take 0.1 seconds to crack" "betterpassword" -> "This password would take 15 seconds to crack" "S89&;al(l_2z0Z¨" -> "This password would take 56 years to crack" Security by fear?

lukifer 16y ago
I love this idea. Is there an easy and accurate-ish algorithm that could generate the numbers involved?
- mcarlin 16y ago
  Meh, this probably encourages people to distrust your website.
  - BoppreH 16y ago
    Excellent insight. Looking back, people would clearly avoid sites that tell them how insecure their accounts are, even if it's for a feel good measure.
- BoppreH 16y ago
  Estimating time with dictionary attacks would be hard because, well, you have to have a dictionary at hand to see how far down the list the word is. Personally, I would make a list of the top 1k or 10k most common passwords and assign a very low number to them. Say, a few seconds max. For any password that is not on the list, get the subset of characters used (upper+lower case, lower case+numbers, symbols+numbers, etc); raise it to the power of the password length to get number of possibilities; multiply by a random number (<= 100) and divide it by the FLOPS of a retail computer. Don't forget to display it at the nearest time unit (seconds, weeks, years). Absolutely naive and a bit too rough around the edges, but good enough to send the message.

wonderzombie 16y ago

Agreed. This is extra creepy. Flagged.

ryandvm 16y ago

> clothed to naked with just "1!aAA" 72 ^ 5 = 1,934,917,632 Good luck brute-forcing that. 5 characters is plenty secure.

Almaviva 16y ago
A billion isn't exactly inconceivably large in this context.

drdaeman 16y ago

Tthey do not measure entropy (very good point about measuring entropy here: http://codereview.stackexchange.com/questions/868/calculating-entropy-of-a-string/878#878 http://codereview.stackexchange.com/questions/868/calculatin...), but just check that password conforms to several simple rules. So, yes, "2tcUKstR" (which I've just generated with `openssl rand -base64 6`) is considered less secure than "Aa1!!". Well, the good thing that they're just suggesting about password's quality, not enforcing it. It really pissed me off when one site declined to accept password and said it was "insecure" just because I was using base64, and (by chance) password did not contain any non-alphanumeric characters. I've also seen another site which rejected "/" in passwords, insisting on /^[A-Za-z0-9]$/ only.