6 ms·
It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on
by Wowfunhappy 5y ago
It also works the other way though. If attackers target the site, they'll know some users have weak passwords, so if you have a strong password, they'll move on quickly to easier targets.
I'd say on the whole it evens out.
- thephyber 5y agoI don’t see this as even remotely “evening out” the parent comment. If a site mandates strong passwords, it is more likely to follow other best practices like throttling login attempts and locking accounts after too many failed attempts (either per account or per IP). If attackers target the site, they should only have a limited number of attempts before they start getting thwarted. It would take a lot of attempts (exact numbers will vary) just to determine if a given user’s credentials are strong or not, so the adversary has already wasted significant effort on the accounts they will eventually “move on” from. If the site has throttling and/ or account lockout, the adversary should not be able to determine who has weak versus strong passwords.
- h_anna_h 5y ago> and locking accounts after too many failed attempts (either per account This is not a best practice, this is a DoS.