News for hackers. Stuff that matters.
Re:Stop forcing arbitrary password rules by JoeAltmaier on Saturday October 24, 2015 @09:32AM (#10443536)
Right, for word choice it is significant. I was thinking, rejecting the whole password pattern.
Re:Stop forcing arbitrary password rules by just_curioussss on Saturday October 24, 2015 @11:48AM (#10443920)
By rejecting a certain pattern you weakening the whole password scheme. It is no longer random, it is human chosen.

An attacker can under certain circumstances exploit this behavior. For example, if they notice you are picking shorter words or words that consist of certain characters, they will have an easier time to crack the password. Whole categories or patterns can be rejected because of that, reducing the search space.

An extreme version of your method, is picking only the patterns that relate exclusively to you, like picking your favorite music or hobbies. Then the whole scheme becomes useless.

Re:Stop forcing arbitrary password rules by JoeAltmaier on Monday October 26, 2015 @08:54AM (#10451048)
Curious notion. So, if a guy got that "human chosen" pattern randomly, they got rooked? He has a very breakable password, while the rest of us got good ones? Sounds like the whole algorithm is busted.