3 ms·
I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password,
by freditup 12y ago
I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website:
Your Account PIN must be:
-6 numbers (no letters or special characters)
-no more than 3 identical numbers in a row (222)
-no more than 3 sequential numbers (such as 234)
If I did the math right, that's approximately 900,000 possible passwords, which is obviously really low
- kevinburke 12y agoYeah, I wrote about this a few years ago and got a lot of press for it. They didn't really fix it, but at least they started rate limiting by IP address. https://kev.inburke.com/kevin/open-season-on-virgin-mobile-customer-data/ https://kev.inburke.com/kevin/open-season-on-virgin-mobile-c...
- freditup 12y agoIs rate limiting by IP the best way to handle something like this (other than the obvious, allowing better passwords)? You could obviously rate limit by account, but then you make it easy for anyone to lock anyone else out of their account. And obviously rate limiting by cookies as mentioned is awful.
- kevinburke 12y agoThere's no great way to "handle" something like this besides modifying the protocol to be less vulnerable.
- fluidcruft 12y agoPhew. Dodged the bullet on forbidding vertical and diagonal strobes of the keypad.
- santosha 12y agoThis is funny because these restrictions reduce the total number of possibilities. I get that the idea was to stop commonly used passwords, but that's what they should have done - disallowed the top N common ones.