3 ms·
Plenty of very secure identity providers allow for a list of banned words. Typically you populate the list with things like the name of the app/website/business
by hunter2_ 6y ago
Plenty of very secure identity providers allow for a list of banned words. Typically you populate the list with things like the name of the app/website/business, the user's name, etc. (rather than vulgarity/dissent as seen here). There is nothing insecure about doing a dictionary comparison right before hashing for storage or regexing for strength constraints.
- rhacker 6y agoAnd these banned words somehow do not stop registration immediately? And these VERY secure identity providers then later show the admin what password was attempted? I would say that's extremely insecure if not a huge privacy violation for something to be considered "very secure", and would definitely not have any form of sign-off from anyone that keeps up to date with OWASP security practices.
- hunter2_ 6y agoEach of those is putting words in mouth and I am on your side for each. Yikes.