Thread

<input type="password" maxlength="20"> prevents me from logging into Vanguard

66 points · 99 comments · tanin

vegetablepotpie · 1790984366 · focus · HN ↗
These are the same companies that state that users are responsible for choosing secure passwords… and then they make this as difficult as possible to do.
Finance needs to be held accountable. They’ve skim off far too much wealth for the value they produced.
1. sippingabonedry · 1790984479 · focus · HN ↗
  > they make this as difficult as possible to do.
  They provided password requirements which he ignored.
  > Finance needs to be held accountable.
  Accountable for what, exactly?
  1. nemomarx · 1790984529 · focus · HN ↗
    if the requirements make it less secure, isn't that the issue op is complaining about? max lengths are an anti feature.
    sippingabonedry · 1790984629 · focus · HN ↗
    Do you believe a 64-character password is magically more secure than a 20-character when they lockout your account after a few wrong tries? Delusion.
    yjftsjthsd-h · 1790984799 · focus · HN ↗
    If an attacker compromises the server and gets hashes, yes it could matter.
    sippingabonedry · 1790985070 · focus · HN ↗
    Sure give or take a few million years.
    A 20 character password is for all practical purposes mathematically immune to being brute forced.
    danaris · 1791051884 · focus · HN ↗
    Except that
    a) when humans generate passwords, they are not perfectly random; they are memorable, which means they often use dictionary words, which are vulnerable to dictionary attacks
    b) even if they use moderately good passwords, that can't be broken with the dictionary, there's a high chance of password reuse, and many passwords have already been leaked
    c) when password managers generate truly random passwords, they run into exactly the problem in the article
    You are so focused on the math of the situation, you ignore the practical realities.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.