News for hackers. Stuff that matters.

A comment on Dropbox employee’s password reuse led to theft of 60M+ user credentials. Parent comment

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by Hermel on Wednesday August 31, 2016 @01:41AM (#12396250)
Enforcing arbitrary password rules. "Must contain at least two '$' characters", "Cannot contain more than one '?'", etc.

However, I think being able to use the same stupid password on all sites I do not care about is a feature rather than a bug.

[ Parent | on HN ]
Re:Dropbox employee’s password reuse led to theft of 60M+ us... by bigiain on Wednesday August 31, 2016 @02:48AM (#12396418)
The problem with that is you never know at signup whether this site is going to be "one you don't care about" 2 or 5 years later.

I had a "stupid" multiply re-used password exposed in a breach of PerlMonks (which I didn't really care about in 2007 or so) which I also used when signing up to check out yet another new social media site in 2008. A couple of years later my Twitter account was sending Acai berry spam to my friends...

(And even if new-site-de-jour doesn't turn out to be something you stick with, it's now got your name (or regular handle) with the risk of damaging your reputation when it gets exploited without you even knowing...)

[ Parent | on HN ]
Re:Dropbox employee’s password reuse led to theft of 60M+ us... by Kadin on Wednesday August 31, 2016 @07:10AM (#12397407)
> you never know at signup whether this site is going to be "one you don't care about" 2 or 5 years later.

Yeah, I mean, my friends talked me into signing up for some stupid site back in 2005, "Face"-something? Seemed pretty trivial to me.

(IIRC in all seriousness Facebook's password requirements were hilariously trivial back when they first started.)

[ Parent | on HN ]
Re:Dropbox employee’s password reuse led to theft of 60M+ us... by therealidiot on Wednesday August 31, 2016 @02:31AM (#12396381)
I recently had a fight with password selection on the Azure portal. They have some truly awful password rules, and I've ended up using something that isn't completely terrible but is much worse than normal, because I simply couldn't get it to accept anything decent.

Thinking about it, my account was added by a company using Azure, perhaps they are able to set the password restrictions for their sub-accounts...

[ Parent | on HN ]