4 ms·

Several years ago I was getting multiple password reset attempts per day from my bank because I picked an easy username to remember 20 years ago. Luckily my ban

by jareds 3y ago

Several years ago I was getting multiple password reset attempts per day from my bank because I picked an easy username to remember 20 years ago. Luckily my bank allowed me to change my user name so I used my password manager to generate a password and used that as my username.

Cthulhu_ 3y ago
One trick I've applied with a wordpress environment is to change the default 'admin' password to something longer / more complicated, change the default location of the admin panel to something else (only works if the admin environment is set up for that), and change the default SSH port. This already defeats 99% of 'low hanging fruit' attempted login attempts.
dpkirchner 3y ago
I had a six character username at Fidelity. Every few weeks I'd get a few password reset emails (or something similar, it was a while ago) and my account would get locked. It was a real pain to deal with but I didn't have a choice, such is the suck of a 401k. Eventually I went with a much longer username and the problem went away. I don't know if this is related (probably not), but fun fact: Fidelity lets you log in to your account over the phone using numbers[0] -- one per character. Yep, passwords too. > Use your telephone keypad to convert the letters to numbers. There is no case sensitivity. Substitute an asterisk (*) for all special characters. Here's an example: > To enter a username, e.g., Smith123, press or say 7-6-4-8-4-1-2-3 > To enter a password, e.g., Lucky1$23, press or say 5-8-2-5-9-1-*-2-3 My 6 letter username mapped to numbers that corresponded to up to 4^6 accounts. That's really bad but not nearly as bad as what they're doing to passwords. The longer username is both worse and better. Worse because it matches way way more possible accounts and better because (I presume) it matches fewer actual accounts so it gets fewer failed attempts. That's my guess, anyway. Edit: it is possible that they only allow one account per "folded" username. That increasing the username length resolved the problem immediately suggests otherwise, but like I said, I dunno. I have no insight into their systems. 0: https://www.fidelity.com/customer-service/faqs-managing-your-profile https://www.fidelity.com/customer-service/faqs-managing-your... look for "telephone services"

by jareds 3y ago

Cthulhu_ 3y ago

One trick I've applied with a wordpress environment is to change the default 'admin' password to something longer / more complicated, change the default location of the admin panel to something else (only works if the admin environment is set up for that), and change the default SSH port. This already defeats 99% of 'low hanging fruit' attempted login attempts.

dpkirchner 3y ago

I had a six character username at Fidelity. Every few weeks I'd get a few password reset emails (or something similar, it was a while ago) and my account would get locked. It was a real pain to deal with but I didn't have a choice, such is the suck of a 401k. Eventually I went with a much longer username and the problem went away. I don't know if this is related (probably not), but fun fact: Fidelity lets you log in to your account over the phone using numbers[0] -- one per character. Yep, passwords too. > Use your telephone keypad to convert the letters to numbers. There is no case sensitivity. Substitute an asterisk (*) for all special characters. Here's an example: > To enter a username, e.g., Smith123, press or say 7-6-4-8-4-1-2-3 > To enter a password, e.g., Lucky1$23, press or say 5-8-2-5-9-1-*-2-3 My 6 letter username mapped to numbers that corresponded to up to 4^6 accounts. That's really bad but not nearly as bad as what they're doing to passwords. The longer username is both worse and better. Worse because it matches way way more possible accounts and better because (I presume) it matches fewer actual accounts so it gets fewer failed attempts. That's my guess, anyway. Edit: it is possible that they only allow one account per "folded" username. That increasing the username length resolved the problem immediately suggests otherwise, but like I said, I dunno. I have no insight into their systems. 0: https://www.fidelity.com/customer-service/faqs-managing-your-profile https://www.fidelity.com/customer-service/faqs-managing-your... look for "telephone services"