 | | Re: Password checks (was: Re: LUGNET Memberships)
|
| (...) As is mine. Todd has one opinion of where that is. Some people think it is too strict. Some are happy. I wonder if any think it is too lenient? (...) I know it is affecting me. Todd sent me a new password and I set two more that hopefully I (...) (26 years ago, 26-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: Password checks (was: Re: LUGNET Memberships)
|
| (...) The BrickShelf uses the cookie returned *and* the ip address that the cookie was issued to for reauthenticate login. Nobody has complained about loosing login yet via multiple proxies (i.e. aol). Also, cookies can be made *much* more difficult (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Password checks (was: Re: LUGNET Memberships)
|
| (...) (URL) [...] On the other hand, a server could probably get around that by (...) I'm very tempted to head in that direction. Even not relaxing the strictness of the validator, I think it would be wise. (...) Cooking hacking is the logical place (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Um, yes I know that. It's also possible to generate "human random" dictionaries that speed up brute force of "strong" passwords where users are forced within certain limits. BTW, I wonder what the keyspace is of all (8 chars and less as (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Is there a way to tell if a given IP address is a shared proxy server or not? If you disable login access as one user from a given IP address, then you effectively disable login access as _all_ users from that IP address, because it would be (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Not if you only disable loggin in as that user from that ip. (...) I think a minimum of 6 characters is a good limit. It's the character diversity that is causeing problems. Also, you could make failed attempts take a few extra seconds to (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| I've been on a few BBSes, quite a while back now, and believe me, some of the passwords that I came up with were quite alphanumeric, and rather random. A hacker's chance of guessing a random, or even semi-random, password is therefore theoretically (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) 36^6 is about equal to 2^31. Maybe it was typical 5-character pw's that resulted in 24-26 bits of true information...I don't remember for sure, it was many months ago. OK, yes, <calculator poking> 36^5 is about equal to 2^26. Also, IIRC, I (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| Hi there! Excuse me if i am totally lost here... Is it not so that a 6 letter password containing letters from A to Z and 0 to 9, can have 36^6 different combinations and contains 48 bits in a unique order? A binary value containing 0 or 1 in 8 (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) ouch. How easy is it for a thief to get your customer number? How many digits is your PIN? (...) natch. :) (...) Disable accounts on repeated fails and you make it trivial to DoS someone. Disable IP addresses and you lock out the innocent on (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Actually, all they need to know is my customer number and a PIN to view my account records. I would consider my bank account records much more valuable than my LUGNET profile, no offense :) If the concern is script kiddies cracking accounts, (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Yup. (...) Done! Thank you very much. Chris (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) I started doing that about 2 weeks ago. It generates a password, sends an email with that password, then stores the encrypted password. The membership packet then contains a backup password. In the case of older members, or if someone deleted (...) (26 years ago, 25-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Wouldn't it be easier to e-mail the forgotten password to the e-mail address your members input upon registration? That e-mail could be intercepted but I don't think a lot of people would go into that kind of trouble to be able to look at (...) (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Internally, it uses a suffix on the set number to avoid ambiguities arising from duplicates issues of a number, for example: (4 URLs) three sets, each numbered 1974, within a larger value pack also numbered 1974 :-). You can add the _1 suffix (...) (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| Todd Lehman <lehman@javanet.com> wrote in message news:G1Evq8.A9o@lugnet.com... (...) 8-digit (...) if (...) at (...) minute, (...) And (...) card (...) One point to note, especially for anyone planning on visiting Australia. ATMs around here will (...) (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Of course not -- because that's patently false. Uhhh, if you chronically have trouble remembering good passwords, you should be writing them down and putting them somewhere *safe* that you trust -- like your dresser drawer at home, or a (...) (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) Oops, with duplicate set numbers that might not be a good idea :) How about adding a UPC field to the db so we can use a CueCat? KL (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) ^^^...^^^ Ack! Don't you realize that's much more insecure than your semi-secure easially rememberable passwords? This is retarded. My banks and credit cards and online trading accounts don't require that much "security", why does my chat (...) (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
| | | | | Re: LUGNET Memberships
|
| (...) most (...) Me too. I've now forgotten all 3 of my passwords, including the two new ones that I worked very hard to come up with memorable phrases that I could remember and that passed that (*&)&@%&$# insanely strict password check. Anything I (...) (26 years ago, 24-Sep-00, to lugnet.people, lugnet.admin.general)
|
|
