what’s an example of password that can be guessed by logic?
Comment on Please create a non-secure password.
Buffalox@lemmy.world 10 months ago
Yes because if you choose 8 characters at random, with 25 small + 25 big letters and 10 numeric, it* only 60^8
= 167,961,600,000,000 combinations.
I think the problem is more if the system allow brute force with thousands of erroneous attempts.
I never got the frantic entropy mindset, when the problem is much simpler to not allow endless attempts. You can allow 50 attempts, and chances would be very slim to guess even pretty moronic passwords.
SwordInStone@lemmy.world 10 months ago
Buffalox@lemmy.world 10 months ago
Something that can possibly be deduced, like a birth date.
Rolder@reddthat.com 10 months ago
hunter2
stevedice@sh.itjust.works 10 months ago
Most websites don’t allow multiple failed logins and, even if they did, the network latency alone would make brute force attacks useless. The point of having a high entropy password is to protect against hackers brute forcing a leaked database of hashes. Having different passwords for every website also protects against this so, as usual, the answer is “just use a password manager”.
purplemonkeymad@programming.dev 10 months ago
I don’t think you need to worry about that in this case, the special character restriction suggests to me that they don’t hash it.
Buffalox@lemmy.world 10 months ago
Seems a bit stupid if a database of passwords or other sensitive information can be brute forced.
stevedice@sh.itjust.works 10 months ago
Please clarify what you mean because your comment is giving me these vibes.
1000014915
Buffalox@lemmy.world 10 months ago
I will never do that, I have a system instead. I never understood why people would want to use a password manager. To me it seems it ads an attack vector, where you could lose EVERYTHING!
stevedice@sh.itjust.works 10 months ago
I guarantee your system is less secure than the worst password manager. Humans are inherently bad at choosing passwords, or anything to do with randomness really.
thepreciousboar@lemm.ee 10 months ago
That is true for online password managers, you need an offline one
frezik@midwest.social 10 months ago
Passwords suck as an authentication system in general. Your own system is probably worse than what password managers do. Yes, there are problems, but so does every other solution to this, and password managers win out in the comparison.
Buffalox@lemmy.world 10 months ago
How so? If you use a password manager across 3 platforms, that makes for 3 attack vectors.
My personal system has guaranteed no vulnerabilities. So how do you conclude my system is worse?