4 ms·
There are at least a few obvious solutions. One is to use long passphrases. Another is to stop trying to memorize your passwords, write them down on a postit, e
by bcl 15y ago
There are at least a few obvious solutions. One is to use long passphrases. Another is to stop trying to memorize your passwords, write them down on a postit, encrypted file, etc. The main threat to your security is not someone digging through the postits in your wallet, it is the hash being stolen from someone's insecure database.
- r00fus 15y agoThe bad part is that some sites (even banks!) force you to limit the number or type of characters. In one ridiculous case, I was forced to use an 8 character pwd with only lowercased letters. The solution is to use tools like KeePass or 1Password to allow maximum length passwords (randomly generated also) wherever possible.
- Joakal 15y agoIt's likely that they are storing passwords in plain text or encrypted. If my website can accept forum posts in UTF-8 of 256+ characters, then people can log in with UTF-8 256+ char passwords.
- code_duck 15y agoI recently signed up for the new payment system for my local water and gas company... you must use your phone number as your user name, and the password, to my suprise, can only be digits, up to 8 characters. Pretty horrible. I wonder what level of idiot designs these systems.
- cdr 15y agoThat "new payment system" is quite possibly interfacing with, say, mainframe code written in the 70s. That's often the source of banks' ridiculous account restrictions.
- code_duck 15y agoI can't see any legitimate technical reason to restrict passwords. In my example, they could put a sensible account system on the front end, and do whatever they need to in the back end to link it to my phone number and a random 8 digit number, if that's what they need. Same with banks. They can set up a real user name and password from you, store it in a modern system, and link it to the older system behind the scenes. Perhaps there's some arcane legislation that prevents this, but it seems unlikely.
- cdr 15y agoThat's certainly true, but it doesn't usually seem to happen.
- reemrevnivek 15y agoI'm far more worried about the plaintext password being stolen from someone's insecure database. But that only reinforces your argument.