4 ms·

> whether or not others are required to use strong passwords has no impact on your privacy. It's worth considering, though, that attackers may target sites tha

> whether or not others are required to use strong passwords has no impact on your privacy. It's worth considering, though, that attackers may target sites that don't mandate strong passwords, because the password hashes in the site's database are likely to be easier to crack (and users with simple passwords are likely to reuse those passwords). Once an attacker has chosen to target that site, that increases the chances that they find themselves able to read your data regardless of the password you used, because they'll have access to the whole database. In fact, a site which hasn't put the engineering effort into enforcing strong passwords (not even a simple regex, let alone more complex approaches like checking for compromised passwords against the haveibeenpwned database) is also likely to have undervalued security in other areas, again making them a target.

Wowfunhappy 5y ago
It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets. I'd say on the whole it evens out.
- thephyber 5y ago
  I don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP). If attackers target the site, they should only have a limited number of attempts before they start getting thwarted. It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.
  - h_anna_h 5y ago
    > and locking accounts after too many failed attempts (either per account This is not a best practice, this is a DoS.

Wowfunhappy 5y ago

It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets. I'd say on the whole it evens out.

thephyber 5y ago
I don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP). If attackers target the site, they should only have a limited number of attempts before they start getting thwarted. It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.
- h_anna_h 5y ago
  > and locking accounts after too many failed attempts (either per account This is not a best practice, this is a DoS.