 | | Re: Password checks (was: Re: LUGNET Memberships)
|
| (...) As is mine. Todd has one opinion of where that is. Some people think it is too strict. Some are happy. I wonder if any think it is too lenient? (...) I know it is affecting me. Todd sent me a new password and I set two more that hopefully I (...) (26 years ago, 26-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: Password checks (was: Re: LUGNET Memberships)
|
| (...) The BrickShelf uses the cookie returned *and* the ip address that the cookie was issued to for reauthenticate login. Nobody has complained about loosing login yet via multiple proxies (i.e. aol). Also, cookies can be made *much* more difficult (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Password checks (was: Re: LUGNET Memberships)
|
| (...) (URL) [...] On the other hand, a server could probably get around that by (...) I'm very tempted to head in that direction. Even not relaxing the strictness of the validator, I think it would be wise. (...) Cooking hacking is the logical place (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Um, yes I know that. It's also possible to generate "human random" dictionaries that speed up brute force of "strong" passwords where users are forced within certain limits. BTW, I wonder what the keyspace is of all (8 chars and less as (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Is there a way to tell if a given IP address is a shared proxy server or not? If you disable login access as one user from a given IP address, then you effectively disable login access as _all_ users from that IP address, because it would be (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Not if you only disable loggin in as that user from that ip. (...) I think a minimum of 6 characters is a good limit. It's the character diversity that is causeing problems. Also, you could make failed attempts take a few extra seconds to (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| I've been on a few BBSes, quite a while back now, and believe me, some of the passwords that I came up with were quite alphanumeric, and rather random. A hacker's chance of guessing a random, or even semi-random, password is therefore theoretically (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) 36^6 is about equal to 2^31. Maybe it was typical 5-character pw's that resulted in 24-26 bits of true information...I don't remember for sure, it was many months ago. OK, yes, <calculator poking> 36^5 is about equal to 2^26. Also, IIRC, I (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| Hi there! Excuse me if i am totally lost here... Is it not so that a 6 letter password containing letters from A to Z and 0 to 9, can have 36^6 different combinations and contains 48 bits in a unique order? A binary value containing 0 or 1 in 8 (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) ouch. How easy is it for a thief to get your customer number? How many digits is your PIN? (...) natch. :) (...) Disable accounts on repeated fails and you make it trivial to DoS someone. Disable IP addresses and you lock out the innocent on (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
|
|
