News for hackers. Stuff that matters.

A comment on Google's Captcha in Firefox vs. in Chrome. Parent comment

Re:Google's Captcha in Firefox vs. in Chrome by therein on Tuesday June 11, 2019 @12:44AM (#20153064)
I imagine what you are proposing then is to record the entropy on the password when you first register and for accounts with sufficient password entropy to not ask for a captcha after few failed attempts.

With that, the site gives away whether the account has a low entropy password or not.

[ Parent | on HN ]
Re:Google's Captcha in Firefox vs. in Chrome by yc12340 on Tuesday June 11, 2019 @01:33AM (#20153208)
> I imagine what you are proposing then is to record the entropy on the password

Or just generate secure high-entropy passwords and force users to use them.

Making users look up SMS codes before each login is acceptable. Making them solve obnoxious, long, privacy-hostile riddles is acceptable. But forcing them to use pre-generated secure passwords?! That can't possibly work. They will revolt!

[ Parent | on HN ]
Re:Google's Captcha in Firefox vs. in Chrome by Dylan16807 on Tuesday June 11, 2019 @05:21AM (#20153933)
> With that, the site gives away whether the account has a low entropy password or not.

Sure, why not? Way more than half of passwords are low-entropy, so that doesn't meaningfully help them focus attacks.

And they still have to keep solving captchas to make those attempts.

[ Parent | on HN ]