HackedThat: Breaking in to a hardened server via the back door

Re:HackedThat: Breaking in to a hardened server via the back... by fapjacks on Thursday August 25, 2016 @05:28PM (#12362658)

I enjoyed the article. It inspired me to participate. However, the Iversoft challenge site has a stupid password policy. Password policies are basically the same thing as just storing them locally in plaintext. Requiring people to perform password gymnastics is the most surefire way to get them to write it down.

[ Parent | on HN ]

Re:HackedThat: Breaking in to a hardened server via the back... by robotdan on Thursday August 25, 2016 @06:31PM (#12363006)

There is probably some truth to this, but I don't know the answer is to allow weak passwords. Every company I've ever worked for enforced some sort of minimum password requirements.

What I do find to be a PITA is when you attempt to create a password that does not meet the minimum rules and the error message gives you no indication of what you need to change to meet the requirement.

[ Parent | on HN ]

Re:HackedThat: Breaking in to a hardened server via the back... by rocqua on Thursday August 25, 2016 @06:40PM (#12363052)

Sure, block the stupidly weak passwords.

But don't block a 6 word diceware phrase because it has not numbers (or because it is to long.... looking at you PAYPAL).

Meanwhile, I'd venture that P@ssword1 meets their requirements...

[ Parent | on HN ]

Re:HackedThat: Breaking in to a hardened server via the back... by robotdan on Thursday August 25, 2016 @09:16PM (#12363702)

fair point.

[ Parent | on HN ]

Re:HackedThat: Breaking in to a hardened server via the back... by newman314 on Thursday August 25, 2016 @06:37PM (#12363037)

Well, the first 3 are ok other than increasing the password length.

Next, they really should be using ed25519 keys if possible. Better, faster and all that good stuff.

[ Parent | on HN ]

Re:HackedThat: Breaking in to a hardened server via the back... by mavhc on Friday August 26, 2016 @04:20PM (#12369033)

Is writing down your password a bad thing? Reduces the attack surface from 510.1 million km² to 5 m²

[ Parent | on HN ]