dual_sport_dork 🐧🗡️

Progenitor of the Weird Knife Wednesday feature column. Is “column” the right word? Anyway, apparently I also coined the Very Specific Object nomenclature now sporadically used in the 3D printing community. Yeah, that was me. This must be how Cory Doctorow feels all the time these days.

  • 22 Posts
  • 810 Comments
Joined 1 year ago
cake
Cake day: July 20th, 2023

help-circle






  • You should probably have some safeguard to prevent jokers from uploading 14.2 gigabytes of absolute nonsense into your system’s password field just to see if they can make it crash. But I think limiting it to, like, 8 kB ought to be quite lenient for anything with a modern internet connection.

    As others have noticed, various hashing functions have an upperbound input length limit anyway. But I don’t see any pressing reason to limit your field length to exactly that, even if only not to reveal anything about what you might be feeding that value into behind the scenes.







  • That works great until some dickhole implements the old, “New password cannot contain any sequence from your previous (5) passwords.”

    This also of course necessitates storing (multiple successive!) passwords in plain text or with a reversible cipher, which is another stupid move. You’d think we’d have gotten all of this out of our collective system as a society by now, and yet I still see it all the time.

    All of these schemes are just security theater, and actively make the system in question less secure while accomplishing nothing other than berating and frustrating its users.




  • Don’t bug users to change passwords periodically. Only do it if there’s evidence of compromise.

    This is a big one. Especially in corporate environments where most of the users are, shall we say, not tech savvy. Forcing people to comply with byzantine incomprehensible password composition rules plus incessantly insisting that they change their password every 7/14/30 days to a new inscrutable string that looks like somebody sneezed in punctuation marks accomplishes nothing other than enticing everyone to just write their password down on a Post-It and stick it to their monitor or under their keyboard.

    Remember: Users do not care about passwords. From the perspective of anyone who isn’t a programmer or a security expert, passwords are just yet another exasperating roadblock some nerd keeps putting in front of them that is preventing them from doing whatever it is they were actually trying to do.