3 ms·
One solution for credential stuffing is to generate passwords for users. I guess ChatGPT doesn't know that one, yet.
by hombre_fatal 1y ago
One solution for credential stuffing is to generate passwords for users.
I guess ChatGPT doesn't know that one, yet.
- stronglikedan 1y ago> generate passwords for users That would rub me the wrong way for sure. Maybe not to the point of abandoning your platform, but I'd still be irked.
- hombre_fatal 1y agoSure, and users are annoyed they don't get to use their go-to "letmein" password as well. But this is worth it for certain platforms, especially where your users have something real to lose when they get pwned by cred stuffing (e.g. bitcoin casino). Personally, I'd go a step further and say it's also worth it anywhere an account takeover can impact other people like Reddit and Twitter where cred stuffing lets you take over high profile accounts and then post a crypto scam or something more targeted, for example. Mild inconvenience on a /register form doesn't sound like a serious counterbalance to the large cost of trivial account takeovers.
- mooreds 1y agoMaybe I don't understand. How are you securely delivering the password to the end user? How are they securely storing a string you created? One that is presumably high-entropy? Or are you talking about one time use passwords (OTP)?