News for hackers. Stuff that matters.

A comment on The dots do matter: how to scam a Gmail user. Parent comment

Re:The dots do matter: how to scam a Gmail user by barking on Sunday April 08, 2018 @05:08AM (#16785329)
because if you know someone's email address you have now also discovered that they have an account with a particular service which you should not be able to do.
[ Parent | on HN ]
Re:The dots do matter: how to scam a Gmail user by bostik on Sunday April 08, 2018 @08:09AM (#16785779)
Furthermore, people reuse passwords. So of course there are a number of known-good login/password combination lists in the wild.

As soon as you find a valid login, you can test all known passwords (plus variations) associated with it.

[ Parent | on HN ]
Re:The dots do matter: how to scam a Gmail user by EGreg on Sunday April 08, 2018 @11:51AM (#16786652)
Can’t you do this anyway on the service? You are assuming there is no rate limiting and the passwords are used directly as bearer tokens to access the site.

But since you are giving advice to the DESIGNER of the site, why not simply tell them not to use passwords? https://qbix.com/blog for example

[ Parent | on HN ]