Passwords. We assume a hard to guess and everchanging password will be hard to crack, but the whole point of machines is that it can be pinpointed with utmost accuracy, and everytime someone tells you to use special phrases in passwords, they’re also inadvertently saying “hey thieves, here is what to look out for, happy guessing”. They’re supposed to be more like speakeasies.
I remember long ago, when I was active as Dabran2 on Neopets, there was a vault with nine dropdown menus that you had to guess the combination to on the moon Kreludor. It was simpler and far more effective. To this day, I couldn’t tell you what’s on the other side (or I’d have to annihilate you and feed your remains to the turmaculus, assuming you believe I made it to the other side).
Passwords, as in user chosen secrets used to prove identity, are a really bad idea in general.
Turns out, people are crappy at coming up with stuff that is hard to guess. They are also crappy at remembering things that are hard to guess.
That’s why every website these days wants to SMS you a code or makes you use an Authenticator.
Thankfully people are catching on, and secure passwordless sign in is gaining ground rapidly.
I’m surprised no place uses IP addresses anymore to authenticate (I was around when Postopia did or whatever that candy themed game place was). Many IP-ban when it comes to identifying rulebreakers, you’d think they’d IP-authenticate too.
Yeah knew a guy that used to work at a place where they had him change his password every 2 months or so kinda stupid. Entropy is really all you need to check. Also by special phrases do you mean salting peppering your passwords?
The peppering passwords? That’s where you add a special word or phrase in all of your passwords but not in your password manager. It’s usually done in case your password manager becomes compromised thats why I got a bit confused with your statement, haha
Passwords. We assume a hard to guess and everchanging password will be hard to crack, but the whole point of machines is that it can be pinpointed with utmost accuracy, and everytime someone tells you to use special phrases in passwords, they’re also inadvertently saying “hey thieves, here is what to look out for, happy guessing”. They’re supposed to be more like speakeasies.
I remember long ago, when I was active as Dabran2 on Neopets, there was a vault with nine dropdown menus that you had to guess the combination to on the moon Kreludor. It was simpler and far more effective. To this day, I couldn’t tell you what’s on the other side (or I’d have to annihilate you and feed your remains to the turmaculus, assuming you believe I made it to the other side).
Passwords, as in user chosen secrets used to prove identity, are a really bad idea in general. Turns out, people are crappy at coming up with stuff that is hard to guess. They are also crappy at remembering things that are hard to guess. That’s why every website these days wants to SMS you a code or makes you use an Authenticator.
Thankfully people are catching on, and secure passwordless sign in is gaining ground rapidly.
I’m surprised no place uses IP addresses anymore to authenticate (I was around when Postopia did or whatever that candy themed game place was). Many IP-ban when it comes to identifying rulebreakers, you’d think they’d IP-authenticate too.
Imagine if your roommate could just get into all your accounts?
I know that’s untactical, but I mean as long as IP bans are already a thing…
All major services do risk based authentication these days. I’m fairly certain network address factors into the risk calculations.
Carrier grade NAT. For instance, on our local mobile phone network, thousands of handsets will have the same public IP address.
Yeah knew a guy that used to work at a place where they had him change his password every 2 months or so kinda stupid. Entropy is really all you need to check. Also by special phrases do you mean
saltingpeppering your passwords?What do you mean?
The peppering passwords? That’s where you add a special word or phrase in all of your passwords but not in your password manager. It’s usually done in case your password manager becomes compromised thats why I got a bit confused with your statement, haha
Yes, or a general way of putting it anyways.
Salting and peppering isn’t something you do; it’s something the site does prior to hashing your password and storing the hash.
Yes you’re correct but what I was referring to was using an extra string of characters to protect against a compromised password manager
Edit: Here’s a link to bitwarden’s website that further clarifies what I meant