3 ms·
I recommend all my friends and family to use a password manager like Bitwarden, and if they can't do that for some reason, at least use a 3-word passphrase sepa
by abustamam 9mo ago
I recommend all my friends and family to use a password manager like Bitwarden, and if they can't do that for some reason, at least use a 3-word passphrase separated by a hyphen.
The amount of times people have complained to me that this doesn't work because of low max-chars on passwords is insane.
- empyrrhicist 9mo agoOne time I had to reset my password with the power company - they had such a system, and the lady had to read me something like: Uh4zB4DP55WD! Apparently I was a bit salty with the system when I set it. The fact that she shouldn't have even been able to look up the password in the first place due to hashing was lost on her.
- abustamam 9mo agoThat's pretty funny on a few levels, not in the least that they required a "secure" password like that but stored them in plain text.
- raddan 9mo agoI regularly conduct transactions at the branch of my local bank wherein they ask me for no credentials whatsoever. I also once forgot to bring my account number with me and the teller said "no worries, I'll look it up for you." Kind of horrifying.
- lostlogin 9mo agoOh! But that’s safe! Secret question time: What’s your mother’s maiden name.
- jazzyjackson 9mo agoIt helps that it’s a jailable offense to make fraudulent transactions
- doubled112 9mo agoIsn’t unauthorized access to a computer system also a jailable offence in most places? Would using the password you gain through this social engineering be doubly illegal?
- empyrrhicist 9mo agoWell... sure. But people be crimeing, and some of these attacks can be done internationally.
- tonyedgecombe 9mo agoMy bank’s password field is case insensitive. Of course they could have lowercased it before hashing but I doubt it.
- abustamam 9mo agoThat's scary. I wonder if incompetence like that could lead to a lawsuit in the case of a breach. At this point I wouldn't be surprised if there exists a system that just asks for username with a checkbox "check here if you are the owner of this account"
- empyrrhicist 9mo agoYeah I was a bit shocked... like... you're not supposed to know that!