3 ms·
> AFAIK basically all the auth attacks we see today are from password re-use https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords says Sum
by joshka 2y ago
> AFAIK basically all the auth attacks we see today are from password re-use
https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords says Summer2024! has been seen in two breaches, which means even if it weren't being brute forced it's less safe. 1235 has been seen significantly more times...
I'm curious if you're just being satirical here - it's not entirely obvious.
- coldpie 2y agoI'm not. If you use a unique password for every service, entropy doesn't matter beyond a low threshold, because guessing passwords against a live service is not an attack people are actually doing. The "1235" is an extreme example, I wouldn't bet my bank account on it, but I still think the point stands.
- ziddoap 2y ago>guessing passwords against a live service is not an attack people are actually doing Credential stuffing is an attack people are actually doing.
- Terretta 2y ago> * guessing passwords against a live service is not an attack people are actually doing* flat wrong ... if one thinks this, one likely isn't operating a high value target