Tag Info

New answers tagged

0

Okay. Let me try to explain this scenario practically using a Windows analogy first: "I was in high school and had chosen Computer Science as my major. We were asked to bring our own laptops. Naturally, being kids we were pretty notorious. Since all of the students in our class had their Windows Logon Password enabled, me and my friend thought that it would ...


1

Setting a firmware password prevents your Mac from starting up from any device other than the built in hard drive. Even if the contents of the hard drive are encrypted, the attacker could still modify the boot sector or copy the contents of the drive.


1

Why is now the time to change your password? If your password has been compromised, then you really should create an entirely new one. Both character-level and semantic correlations between your old password and new password can reduce the attack space for a brute-force attack substantially. As others have pointed out, susceptibility to a brute force attack ...


0

Banks are normally very large, bureaucratic organizations driven by policies written by people that were well meaning, but can't respond very well to changing threats. Are Phishing attacks worse than compromised machines where the password is stolen? I'm not sure, but it's a valid discussion. Saving the password locally is easy to understand, and for ...


3

While there are aspects of truth in what you say, you have to look at the bigger picture and look at where banks have liabilities and risks. Banks look to minimise the risk down to a certain level (eg there is a fraud appetite that is accepted by banks, as to try and reduce it further costs more and more, rapidly becoming unworkable) and many of these ...


2

Banks have real money losses, a significant amount of this comes from unauthorized access to bank accounts so they have financial incentives to make it harder for users to lose their password by storing it in the browser at their local internet cafe/library/etc.


12

Drilling a bit deeper on the copy and paste issue: Microsoft products, particularly the Office suite, are notorious for attempting to help by adding trailing white space to items copied from, say, Outlook and pasted elsewhere. The purpose of doing this is so that you don't have to be as careful where you place the cursor when copying and pasting to avoid ...


4

It's probably a usability issue. It's very easy to unintentionally accidentally add a space to the beginning or end of a username or password, especially on certain types of devices: mobile with autocomplete, people typing via voice, people using assistive technologies that auto-insert spaces, copying and pasting passwords, etc. The other day I was ...


15

They trim passwords to deal with the (sometimes insecure) process of people copying and pasting them.


9

Because they trim whitespace. The why of that is not known, but is not unusual, and often is related to the inability for humans to discriminate - you and I know that foo bar has a space in the middle, but it's hard for us to say how many spaces are in foobar if any of them are trailing. Judging from productforums posts, this policy is not new.


0

The specific-conditional entropy can be greater than the entropy. This is the key mathematical fact. You are arguing about the number of combinations but you should be arguing about entropy. These kinds of password policies only make sense if the user picks the password and is not uniformly generated. In these cases, by restricting the possible pool of ...


2

This has had some good pointers to password strength, so the OP's question is probably not important. I think dexgecko had it right, but was hard to read. So in the interest of answering questions as simply as possible: Let X = { ten character passwords } Let A = { ten character passwords with no letters } Let B = { ten character passwords with no numbers ...


1

My companion was arguing that this policy is weaker than one that requires at least 10 characters. A password policy is designed to prevent "weak" passwords (more on what this actually means below), therefore it has to be judged on the weakest password that can be created under it, not by the number of passwords that can possibly be encoded with it. ...


1

So I'm going to try and answer how many combinations actually exist for each policy. Please post a comment if you feel the logic is flawed. First we look at the number of characters available when including each of numbers (N), letters (L) and specials (S). N - 10 L - 52 S - 33 LS - 85 NS - 43 NL - 62 NLS - 95 EDIT : For the first policy, we ...


7

Your companion is right that the least restrictive policy has a higher potential entropy, as it can encode a larger amount of information. This being said, the entropy of a set of data depends on the probability distribution of each datum appearing in the dataset. Therefore, the quality of a password policy should not be measured in terms of how much ...



Top 50 recent answers are included