4 ms·
Dictionary attacks are incredibly effective. Humans have a hard time coming up with unique passwords.
by andrewchambers 12y ago
Dictionary attacks are incredibly effective. Humans have a hard time coming up with unique passwords.
- crocowhile 12y agoThey are also quite easy to prevent, though.
- andrewchambers 12y agoThey are, but the average granny or non tech person doesn't care enough.
- crocowhile 12y agoI was thinking server side..
- aianus 12y agoIt'd be nice if Windows/OSX/iOS/Android came with 1Password out of the box. It's both easier to use and more secure than manual passwords, which is a rare combination.
- stephenr 12y agoSafari on OSX & iOS does do random password suggestions, out of the box.
- zyxley 12y agoI've found this to work pretty well in most cases, but there are some websites that don't semantically mark up their fields in a way the browser can recognize, and there's no way to manually trigger the password suggestion feature.
- Tloewald 12y agoWorse, many sites -- notably banking sites -- reject secure passwords (no weird characters, no long passwords)
- hraedon 12y agoOne of my credit cards requires a password no longer than 16 characters, no spaces, no special characters. They're only a few more restrictions away from just requiring that it be a significant birthday or something similar.
- stusmall 12y agoWhat is worse than rejecting is I know of one major site that would, at least used to, silently truncate long passwords. That was... frustrating.
- cynwoody 12y agoI used to have an ATM card with an 8-digit PIN. When entering the PIN, I noticed the screen would flash after the fourth digit. Subsequently, I discovered I actually only needed to enter the first four. That continued until the bank got taken over by Bank of America in 2004. Suddenly, I needed to enter the whole PIN!
- stephenr 12y agoI think generally all it needs is a password field. My Thai business banking system is paranoid and disables autocomplete, paste, etc, even with the security of a physical token), but the one that really annoys me is things like Basecamp - I had to futz around and disable JavaScript for a login to be recognised and prompt to save a password - by default it does an XHR which doesn't trigger the "save password" prompt.
- Cthulhu_ 12y agoAnd most services with password strength requirements, for that matter.
- Semaphor 12y agoIt's actually quite easy using something like the battery horse staple thing. Most people just don't care enough about passwords.