Need a Strong Password?

[chasemanmusic]

Ha that is hanging in my office

---------- Post added at 08:56 PM ---------- Previous post was at 08:45 PM ----------

@boxxa

On a serious note, the worry is that someone who steals a weaker DB like NYSpeed will have your email and password and the general user uses the same password for every account they can.

NYSpeed DB -> username, email, password -> try password as email password -> find past emails for accounts such as FB, banks, etc. and reset passwords since you can view the email -> access to more sites with just your NYSpeed password

Smart people have weaker passwords for sites, more complex ones for more sensitive information adn then the central email accoutn should be super secure. It may sound simple to tech people but a lot of people do not really think about this.

Esp when some asshat in a backhoe hits it.

Tru dat

---------- Post added at 08:57 PM ---------- Previous post was at 08:56 PM ----------

Yea just figured out how to do that. That is what is hanging in my office.

@boxxa

On a serious note, the worry is that someone who steals a weaker DB like NYSpeed will have your email and password and the general user uses the same password for every account they can.

NYSpeed DB -> username, email, password -> try password as email password -> find past emails for accounts such as FB, banks, etc. and reset passwords since you can view the email -> access to more sites with just your NYSpeed password

Smart people have weaker passwords for sites, more complex ones for more sensitive information adn then the central email accoutn should be super secure. It may sound simple to tech people but a lot of people do not really think about this.

Esp when some asshat in a backhoe hits it.

@boxxa

dasd$3rfd@ is not a secure password.
R3@llyC00l is not a secure password.

redhorsepilotcanyon is more secure mathematically. also, based on general public, companies that require 8-10 letter “complex” passwords leave their users to write them down on a pad of paper next to their desk. companies that do not allow long passwords are less secure than the admin making password rules like the following list I have seen:

no repeating letters
must contain letter, number, and symbol
must not be one used the last 10 times
must start with a capital letter (this itself makes the first character only 26 guesses)

Also, certs are only as trust worthy as the providers of them. The best security that is used at high level banks is client certs that are all based on machines and issued on an internal CA. Hell, the Iranian government was issued certificates to man in the middle all the Google sites recently.

Also, if you have no account locking on failed login attempts, you deserve to be hacked.

[chasemanmusic]

Have you guys heard of pass the hash?
http://oss.coresecurity.com/projects/pshtoolkit.htm

Pretty cool stuff. Windows cant fix this i heard.

[Random_Hero]

@tpgsr

SHIT that thing guessed my password. Crazy. It is/soon to not be *********

Edit: wow, if you type your password the forum automatically replaces it with asterisks. Cool.

Really? Thats pretty cool…why does it do that?

gingersnaps69

[boxxa]

@Random_Hero

Really? Thats pretty cool…why does it do that?

gingersnaps69

Hahahahahahahahahhahahahahahahahahahah