what’s an example of password that can be guessed by logic?
Comment on Please create a non-secure password.
Buffalox@lemmy.world 2 months ago
Yes because if you choose 8 characters at random, with 25 small + 25 big letters and 10 numeric, it* only 60^8
= 167,961,600,000,000 combinations.
I think the problem is more if the system allow brute force with thousands of erroneous attempts.
I never got the frantic entropy mindset, when the problem is much simpler to not allow endless attempts. You can allow 50 attempts, and chances would be very slim to guess even pretty moronic passwords.
SwordInStone@lemmy.world 2 months ago
Buffalox@lemmy.world 2 months ago
Something that can possibly be deduced, like a birth date.
Rolder@reddthat.com 2 months ago
hunter2
stevedice@sh.itjust.works 2 months ago
Most websites don’t allow multiple failed logins and, even if they did, the network latency alone would make brute force attacks useless. The point of having a high entropy password is to protect against hackers brute forcing a leaked database of hashes. Having different passwords for every website also protects against this so, as usual, the answer is “just use a password manager”.
purplemonkeymad@programming.dev 2 months ago
I don’t think you need to worry about that in this case, the special character restriction suggests to me that they don’t hash it.
Buffalox@lemmy.world 2 months ago
Seems a bit stupid if a database of passwords or other sensitive information can be brute forced.
stevedice@sh.itjust.works 2 months ago
Please clarify what you mean because your comment is giving me these vibes.
1000014915
Buffalox@lemmy.world 2 months ago
I will never do that, I have a system instead. I never understood why people would want to use a password manager. To me it seems it ads an attack vector, where you could lose EVERYTHING!
stevedice@sh.itjust.works 2 months ago
I guarantee your system is less secure than the worst password manager. Humans are inherently bad at choosing passwords, or anything to do with randomness really.
thepreciousboar@lemm.ee 2 months ago
That is true for online password managers, you need an offline one
frezik@midwest.social 2 months ago
Passwords suck as an authentication system in general. Your own system is probably worse than what password managers do. Yes, there are problems, but so does every other solution to this, and password managers win out in the comparison.
Buffalox@lemmy.world 2 months ago
How so? If you use a password manager across 3 platforms, that makes for 3 attack vectors.
My personal system has guaranteed no vulnerabilities. So how do you conclude my system is worse?