3 ms·
So much of a downgrade to this would simply be using the sentence and the word directly? Say, for instance, my H.N. password be “TheThermonuclearCatRevolutionI
by Blikkentrekker 6y ago
So much of a downgrade to this would simply be using the sentence and the word directly?
Say, for instance, my H.N. password be “TheThermonuclearCatRevolutionIsUponUsAndShallUndoUsAllHackerNews”? Is there any particular caveat under the assumption that no website would be silly enough to store it in plain text?
- kevin_thibedeau 6y agoThey truncate to 31 chars and laugh at your attempt to increase entropy.
- tubbyjr 6y agodoesnt paypal limit you to 20, and some banks i have to 12 characters...
- tubbyjr 6y agoNo website being silly enough to store in plaintext, is silly untoitself https://www.upguard.com/blog/biggest-data-breaches https://www.upguard.com/blog/biggest-data-breaches plenty of cases where it happens... and plenty more of viably crackable breaches
- Closi 6y agoIn addition to plaintext data breaches, there are also the risks of Phishing (if one password can open many accounts) and a malicious website owner just deciding to harvest user/password combos on his own signup script.
- tonyedgecombe 6y agoMy bank password is case insensitive. It could be they are lower casing it before they hash it or they could be storing it in plain text. Judging by the mess they make of their systems I would say it's the later.
- tubbyjr 6y agomy gf can omit last x chars for hers and it's still accepted, can't recall what x was. Banks are so funny
- asciimike 6y agoFor a while (maybe pre-2015?) Charles Schwab had users append the 6 character 2FA code to the end of your password (which itself was limited to between 6 and 8 chars), so they were either splitting it client side or storing everything in plaintext...