3 ms·
> because they are not taking security seriously? I don't think is necessarily the case. You can take security seriously, but there are limits, and you have to
by rplnt 5y ago
> because they are not taking security seriously?
I don't think is necessarily the case. You can take security seriously, but there are limits, and you have to balance the effort with the willingness of someone breaching your safeguards.
I would use a bicycle as an example. You can buy whatever lock you want, it can be broken by someone. The better the lock, the less people can get through it or are less inclined to do so anyway. You can pay a security guard to look after your bike, but at some point, if your bicycle is really valuable, one guard can be bribed (or killed), and so on, and so on.
In summary, just because they were "hacked" does not mean they are not taking security seriously.
- silviot 5y ago> In summary, just because they were "hacked" does not mean they are not taking security seriously. To some extent though it does mean they were not taking security seriously _enough_. In your example, they misjudged whether they needed a guard or not. [EDIT] Actually, I realized it's not about taking it seriously, but executing it efficiently.
- sabas123 5y agoEven so, they could have defended perfectly against a threat model, which might have been completely reasonable. But it might have been pure bad luck. Although I don't know any of the details.
- darumderum 5y ago> I don't think is necessarily the case Back then, when they enforced a maximum 16 character password, I saw enough security. Are they storing them in plaintext or what? Btw, I think they increased the limit to 32 now
- kenniskrag 5y agosome hashing algorithm don't allow longer passwords. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#:~:text=bcrypt%20has%20a%20maximum%20length,be%20enforced%20when%20using%20bcrypt https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor....
- darumderum 5y agoWell, 72 bytes is still far away from 16 characters. Also, nearly every website is able to allow passwords longer than 16 chars, so it is definitely possible somehow!? This limit is ridiculous
- kenniskrag 5y agoalso in unicode? (4 byte * 19 chars)
- darumderum 5y agoNo, but they don't support it anyways
- TomSwirly 5y ago1. Unicode has no idea of "bytes" at all. 2. Only in the UTF-32 encoding, which no one uses, are all characters represented by 4 bytes. Most sites today use UTF-8 where most characters on a standard keyboard are 1 byte, and almost all characters from any language take 3 bytes. 3. Even 19 characters is a lot better than 12.
- deleted 5y ago[deleted]
- thih9 5y agoIs this is a good reason to reject long passwords? If that kind of hashing algorithm is a must, why not use first X bytes of the password input?
- jfrunyon 5y agoBecause then people find out that it ignores a bunch of your password and people's "password12DHpS*yoCTV44cAmg$gJj" is matched by "password123". Or "correct horse battery staple i have the most brilliant password ever" is matched by "correct horse battery staple".