News for hackers. Stuff that matters.
Re:The “Cobra Effect” that is disabling paste on password fi... by yk on Sunday June 26, 2016 @05:23AM (#11980004)
The problem is, if you have a bunch of partial passwords 1, 2, 3; 1, 2, 4; ... you can just brute force three character combinations of the passwords, which just takes something half a second (times the number of rounds) if you write your password cracker in bash. So your complexity goes from 52^n for a n character password consisting of lower and upper case to n/3* 52^3 which is a lot more manageable.
Re:The “Cobra Effect” that is disabling paste on password fi... by OJFord on Sunday June 26, 2016 @05:49AM (#11980066)
But three strikes and your out - out to the physical bank with proof of ID to change it.
Re:The “Cobra Effect” that is disabling paste on password fi... by MereInterest on Sunday June 26, 2016 @06:20AM (#11980161)
You're assuming that the verification is being done by the bank itself. This is under the assumption that there has already been a security breach. The password database has been stolen, and has just been sold to the highest bidder. In that case, there is no lockout.
Re:The “Cobra Effect” that is disabling paste on password fi... by coldcode on Sunday June 26, 2016 @09:03AM (#11980588)
Not if they steal the database. No matter how you limit the external access you also have to protect against people with unlimited time with a copy.
Re:The “Cobra Effect” that is disabling paste on password fi... by ATsch on Sunday June 26, 2016 @09:06AM (#11980597)
That is nice and all, but the scenario we are talking about is a db compromise, in which case any rate-limiting is circumvented.
Re:The “Cobra Effect” that is disabling paste on password fi... by Dylan16807 on Sunday June 26, 2016 @10:19AM (#11980891)
That defense also works for plaintext passwords.

Tell me why plaintext password storage is bad, and you'll defeat your own argument.