3 ms·
OK, I'll bite: can you give us some ideas on how this would lead to a genuine advancement in user authentication (that we wouldn't have with username/pw de-link
by pbreit 12y ago
OK, I'll bite: can you give us some ideas on how this would lead to a genuine advancement in user authentication (that we wouldn't have with username/pw de-linked)?
- totony 12y agoExample: Username: mickael Password: mickael69 EDIT: Just to be more precise, there is a correlation here, and with so much data a lot can be known. Patterns can then be forbidden from password fields so the website is less prone to dictionary attacks.
- pbreit 12y agoSo what would you do here? Disallow "mickael" from the password? That's pretty user-hostile and almost completely pointless.
- totony 12y agoIs it pointless to reduce the attack vector against your website? And, no, for a banking system, it is not that user-hostile to say things like "we have found that using <pattern> in your password makes it easy for people to guess, please choose a more complicated password".