4 ms·
With passwords you will get even higher probability if you just try 100 most popular passwords allowed by the service on hundreds of thousands of users. Try ma
by Isinlor 4y ago
With passwords you will get even higher probability if you just try 100 most popular passwords allowed by the service on hundreds of thousands of users.
Try making password creation too difficult and now password reset will be the default authentication for a lot of users anyway.
- aaaaaaaaaaab 4y agoThe 100 most popular passwords should already be blacklisted during registration, so it wouldn't be possible to set them as your password. I have nothing against password-reset-as-authentication aka "magic links", when done properly. And by properly I mean not using an ultra-low entropy auth code, like the parent is proposing (6 decimal digits, aka 20 bits of entropy).