Re:Pwned Passwords in Practice: Real World Examples of Block...
by perl4ever on Tuesday May 29, 2018 @07:21PM
(#17183606)
Soliciting people to enter their passwords seems like a bad approach both because it's risky and because it helps train people to do risky things - better would be a service that attempts to crack passwords and if it succeeds, disables the account until a new password is set. Seems like a service that everybody should use, if it existed. Much better than arbitrary rules about "good" password character sets.
[ Parent
| on HN ]
Re:Pwned Passwords in Practice: Real World Examples of Block...
by goodpass on Tuesday May 29, 2018 @07:34PM
(#17183672)
There’s no one specific way to crack a password. It all depends on the implementation. The most basic case is just storing the password in plaintext, and plenty of companies are more than happy to do that. Passwords don’t exist as some separate entity, they’re attached to a system. So cracking an Adobe password might be easy, but cracking a Dropbox password incredinly hard.