3 ms·
Password length and complexity aren't all that critical if it's salted and hashed. Locking out a user after a number of incorrect attempts and then requiring a
by eksith 14y ago
Password length and complexity aren't all that critical if it's salted and hashed. Locking out a user after a number of incorrect attempts and then requiring a different password during the reset than the one already used is a better alternative.
Reusing passwords on different sites is a much bigger problem IMO since a lot of places still don't store passwords correctly or don't lock out users after failed attempts.
- cantankerous 14y agoPassword length and complexity aren't all that critical if it's salted and hashed. Unless your users' passwords are something like "password" or their user names. Password length and complexity are important, if overplayed.
- eksith 14y agoAh yes, well... if they're using 'password' for the password, they've got bigger problems ;) Passwords that can be guessed in 1-3 tries should be excluded, naturally: password, 12345, 11111 etc... But mixed case, special character stuff is a bit redundant.
- mergy 14y agoPretty sure the issue I had to deal with was related to the Java OSX exploit. That being said, it is a total trade-off vs. security or ease of use for the end-users.