3 ms·
How important is a high entropy password for web services that properly encode passwords and limit brute force attempts? It's my understanding that the biggest
by MichaelApproved 14y ago
How important is a high entropy password for web services that properly encode passwords and limit brute force attempts? It's my understanding that the biggest issue is stolen passwords or captured login cookies that cause the most problems.
I'm genuinely curious to hear the argument.
- tnorthcutt 14y agoIt's probably fairly common that $high_entropy_password != $password_used_elsewhere. In other words, if a user uses a high entropy password, there's a better chance that they're not reusing it elsewhere, thus improving security.
- MichaelApproved 14y agoNot that common for me. I know several users who have 1 simple & 1 complicated password that's used depending on the site's requirements. Those two password are used repeatedly.