News for hackers. Stuff that matters.

A comment on We'd lose our security certificate if we allowed pasting. Parent comment

Re:We'd lose our security certificate if we allowed pasting by freditup on Tuesday May 06, 2014 @09:21AM (#7704235)
I have Virgin Mobile in the US (it's one of the cheapest options with good quality phones), and it seems the same. It made me set a 6-digit PIN as my password, and my phone number is my username. Here are the requirements listed on their website:

Your Account PIN must be:

-6 numbers (no letters or special characters)

-no more than 3 identical numbers in a row (222)

-no more than 3 sequential numbers (such as 234)

If I did the math right, that's approximately 900,000 possible passwords, which is obviously really low

[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by kevinburke on Tuesday May 06, 2014 @10:16AM (#7704556)
Yeah, I wrote about this a few years ago and got a lot of press for it. They didn't really fix it, but at least they started rate limiting by IP address. https://kev.inburke.com/kevin/open-season-on-virgin-mobile-c...
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by freditup on Tuesday May 06, 2014 @11:29AM (#7705047)
Is rate limiting by IP the best way to handle something like this (other than the obvious, allowing better passwords)? You could obviously rate limit by account, but then you make it easy for anyone to lock anyone else out of their account. And obviously rate limiting by cookies as mentioned is awful.
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by kevinburke on Tuesday May 06, 2014 @11:42AM (#7705116)
There's no great way to "handle" something like this besides modifying the protocol to be less vulnerable.
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by santosha on Tuesday May 06, 2014 @10:29AM (#7704653)
This is funny because these restrictions reduce the total number of possibilities. I get that the idea was to stop commonly used passwords, but that's what they should have done - disallowed the top N common ones.
[ Parent | on HN ]
Re:We'd lose our security certificate if we allowed pasting by fluidcruft on Tuesday May 06, 2014 @10:23AM (#7704609)
Phew. Dodged the bullet on forbidding vertical and diagonal strobes of the keypad.
[ Parent | on HN ]