3 ms·

There are a couple of solutions (neither are "good" if you're worried about being sued to oblivion ) : 1) Don't publicize how you reject passwords (this, obvio

by eksith 14y ago

There are a couple of solutions (neither are "good" if you're worried about being sued to oblivion ) : 1) Don't publicize how you reject passwords (this, obviously, won't work for open source). You can reject with a generic "please choose a different one" or something similar. Just vague enough to not directly show that you're reading off a list of bad passwords. 2) Ignore the patent. I'm a fan of 2, but fighting a troll alone is most definitely not an option. If I do get sued, perhaps I can contact all other people who were also sued (since trolls tend to fire shotgun lawsuits to see which ones buckle) and fight back together to try and get the patent invalidated. Meanwhile, I can write to congress (have all the others do the same) and wait for it to have no effect whatsoever since, obviously, we all know that what really kills American jobs is those damn immigrants /sarcasm.

bjxrn 14y ago
It's not just going over a blacklist though. If you do any form of checking/rejecting a password, you're probably infringing something. And it's not just the checking, the article also mentions "recovery of forgotten passwords, secure password resets, using one-time passwords, account lockout, generating pronounceable passwords, password hints, and even backdoor passwords".
- cynwoody 14y ago
  > generating pronounceable passwords Prior art! That program was written by thvv in 1994[1], based on much earlier work[2]. [1] http://manpages.ubuntu.com/manpages/quantal/en/man1/gpw.1.html http://manpages.ubuntu.com/manpages/quantal/en/man1/gpw.1.ht... [2] http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA017676 http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA017676
msluyter 14y ago
What if you didn't reject the passwords outright, but simply warned the user. I wonder if that would be considered a violation? Also the patent "Specifying a set of forbidden passwords" includes: "generating at least one symbolically equivalent password". What if you didn't generate a symbolically equivalent password (but just did a direct lookup?)
YokoZar 14y ago
Attempting to avoid infringing software patents like this is an absolute waste of time. There are vast amounts of terrible patents covering everything you do, and even if you don't technically infringe the mere allegation that you do by a patent troll is enough of a threat to make settlement more profitable. That's why it's been compared to extortion.
hashmymustache 14y ago
Yea it's a pretty ridiculous state we're in. Fortunately this patent was probably filed defensively by RIM, but the moment they decide in the next 20 years that a branch could be more profitable by firing their employees and siphoning some intellectual property into a litigious happy NPE, then any group rejecting user passwords that look like p@ssword will be in violation until the year 2031
- caf 14y ago
  This would be the company that was once known tongue-in-cheek as "Lawsuits In Motion".
mesozoic 14y ago
Willful infringement triples any judgement against you. Just a note for those who didn't know.

by eksith 14y ago

bjxrn 14y ago

It's not just going over a blacklist though. If you do any form of checking/rejecting a password, you're probably infringing something. And it's not just the checking, the article also mentions "recovery of forgotten passwords, secure password resets, using one-time passwords, account lockout, generating pronounceable passwords, password hints, and even backdoor passwords".

cynwoody 14y ago
> generating pronounceable passwords Prior art! That program was written by thvv in 1994[1], based on much earlier work[2]. [1] http://manpages.ubuntu.com/manpages/quantal/en/man1/gpw.1.html http://manpages.ubuntu.com/manpages/quantal/en/man1/gpw.1.ht... [2] http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA017676 http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA017676

msluyter 14y ago

What if you didn't reject the passwords outright, but simply warned the user. I wonder if that would be considered a violation? Also the patent "Specifying a set of forbidden passwords" includes: "generating at least one symbolically equivalent password". What if you didn't generate a symbolically equivalent password (but just did a direct lookup?)

YokoZar 14y ago

Attempting to avoid infringing software patents like this is an absolute waste of time. There are vast amounts of terrible patents covering everything you do, and even if you don't technically infringe the mere allegation that you do by a patent troll is enough of a threat to make settlement more profitable. That's why it's been compared to extortion.

hashmymustache 14y ago

Yea it's a pretty ridiculous state we're in. Fortunately this patent was probably filed defensively by RIM, but the moment they decide in the next 20 years that a branch could be more profitable by firing their employees and siphoning some intellectual property into a litigious happy NPE, then any group rejecting user passwords that look like p@ssword will be in violation until the year 2031

caf 14y ago
This would be the company that was once known tongue-in-cheek as "Lawsuits In Motion".

mesozoic 14y ago

Willful infringement triples any judgement against you. Just a note for those who didn't know.