3 ms·
Beautifully written. Also worth noting is that sites exist that only use lower(trunc(password, 8), so your first 8 characters should be sufficiently random. For
by jackalope 14y ago
Beautifully written. Also worth noting is that sites exist that only use lower(trunc(password, 8), so your first 8 characters should be sufficiently random. For the grandparent, that leaves "my first", which is especially weak in a dictionary attack.
- JD557 14y agoI don't get it. Is there a reason for some sites to actually do that? (considering that they don't store your password as plaintext) I guess if someone stole their database it would be impossible to know your real password, but still... Or am I missing something here?
- jackalope 14y agoSome sites lowercase all passwords after they are input to "help" users who hit caps lock or are otherwise challenged by case sensitivity. Then you have DES crypt (as once used by Gawker), which only uses the first 8 characters of the password. A site which uses either or both of these methods may happily let you type in a password of any length or complexity, but the version they use will have significantly lower entropy. I've even seen sites silently strip special characters.
- tripzilch 14y ago> I don't get it. Is there a reason for some sites to actually do that? Yes it's to save space ... No, wait. It's so they don't use all the CPU power ... No, not that either. It's because the programmer didn't want to use their braincells. Yeah, that would be it.
- re_todd 14y agoI've heard of sites truncating to only use the first 8-12 characters as well. So if you are going to use lots of words, put them after a highly complex first 8 characters.