3 ms·
> What I'll argue is that it's not a best practice, because nobody practices it. And now you're begging the question! Actually, some people use it :-). It sh
by pygy_ 14y ago
> What I'll argue is that it's not a best practice, because nobody practices it.
And now you're begging the question!
Actually, some people use it :-).
It shuts down an attack vector, and it's cheap to implement. Why is it silly? My rule of thumb is to treat all passwords equivalents in the same way.
I'm honestly surprised by your hostility towards the idea (not mine, BTW), and by the downvotes for promoting a strategy that provably (in the math sense) increases security.
- tptacek 14y agoName one. You don't count.
- pygy_ 14y agoHere's where I read about it: http://stackoverflow.com/questions/549/the-definitive-guide-to-forms-based-website-authentication http://stackoverflow.com/questions/549/the-definitive-guide-... Edit: Even if it were just me, it doesn't make the argument invalid. Your arguments so far are 1) it's unlikely to be the weakest link. Textbook case of Murphy's law, 2) nobody does it, and 3) I've never recommended it, therefore it's useless. I don't understand how you can resort to that... Seriously, I'm at loss here. Are you waiting for a high profile attack to react? I know you have a reputation to defend, but I think you screwed it somehow in this case. At least, it proves you're not a machine :-)