News for hackers. Stuff that matters.

A comment on Amazon.com Security Flaw Accepts Passwords That Are Close, But Not Exact.

Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by CamperBob on Friday January 28, 2011 @07:51PM (#2154141)
What exactly does this hurt? It cuts down on customer-support traffic, makes life easier for the user, and (as far as I can imagine at least) doesn't make anyone any more vulnerable. Under a fuzzy comparison scheme, weak passwords are still weak, and strong passwords will still be strong.
[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by RickHull on Friday January 28, 2011 @08:05PM (#2154180)
> strong passwords will still be strong.

I think you meant: strong passwords will be truncated down to 8 chars, making them weak.

[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by jemfinch on Saturday January 29, 2011 @12:33AM (#2154756)
Strong, 8-character passwords are 1 in 5132188731375616. Is that really so weak?
[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by nbpoole on Saturday January 29, 2011 @02:19AM (#2154959)
That depends on how fast you can check for validity.

See http://news.ycombinator.com/item?id=2003888 or http://news.ycombinator.com/item?id=1545576 for examples of how fast certain types of brute-force attacks have become.

[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by kgermino on Friday January 28, 2011 @11:01PM (#2154573)
To be fair almost any password is weak if it hasn't been changed in several years.
[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by jackowayed on Friday January 28, 2011 @08:07PM (#2154187)
A strong password that gets a lot of its strength from length and mixed case will not still be strong under this error.

For example, the password fOoBaRbAzbArBaZFoO would be a pretty strong password. foobarba is much weaker, and this error would make foobarba (and foobarbaz, etc) work.

[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by CamperBob on Friday January 28, 2011 @11:12PM (#2154587)
A strong password like that is written down on a Post-It note on the user's monitor, and hence is not very strong at all.
[ Parent | on HN ]
Re:Amazon.com Security Flaw Accepts Passwords That Are Close... by nialo on Saturday January 29, 2011 @07:06AM (#2155277)
A password of that sort is both not that hard to remember and probably fine on a post-it not on the monitor of your home computer. There's really not much overlap between the sorts of people who will break passwords and who will be in a position to read things on your monitor.

(and if they can, some browser password auto-save feature is going to screw you anyway so it doesn't matter)

[ Parent | on HN ]