Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #2983 > unrolled thread

Ebay hacked

Back to article view | Back to comp.misc

Contents

  Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-22 17:38 +1000
    Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-22 13:35 +0000
      Re: Ebay hacked Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2014-05-24 14:32 +0100
    Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-22 15:59 +0000
      Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-23 17:06 +0300
        Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:13 +0000
          Re: Ebay hacked Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-24 20:45 +0100
            Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:33 +1000
              Re: Ebay hacked Jerry Peters <jerry@example.invalid> - 2014-05-25 20:19 +0000
                Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 21:50 +0000
        Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 16:53 +0000
          Re: Ebay hacked Anssi Saari <as@sci.fi> - 2014-05-24 21:12 +0300
            Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 18:33 +0000
              Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:37 +1000
                Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 13:46 +0000
                  Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 16:55 +1000
                    Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:42 +0200
            Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-27 13:38 +0200
          Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:32 +0000
          Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:36 +1000
            Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-25 14:00 +0000
              Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 17:18 +0200
            Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-25 22:53 +0200
              Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:03 +1000
                Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:17 +0000
                  Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-27 15:18 +1000
            Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-26 06:57 +0000
              Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-26 17:07 +1000
                Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:21 +0000
                Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-27 05:53 +0000
              Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 13:19 +0000
              Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-26 18:46 +0200
        Re: Ebay hacked "BartC" <bc@freeuk.com> - 2014-05-24 20:54 +0100
          Re: Ebay hacked Rich <rich@example.com> - 2014-05-24 20:24 +0000
          Re: Ebay hacked Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-24 22:35 +0000
    Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-23 00:28 +0100
      Re: Ebay hacked simple@machines.gopher - 2014-05-23 14:30 +0000
        Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 00:36 +1000
          Re: Ebay hacked Paul Sture <nospam@sture.ch> - 2014-05-24 13:34 +0200
      Re: Ebay hacked mm0fmf <none@mailinator.com> - 2014-05-23 18:21 +0100
        Re: Ebay hacked Tim Streater <timstreater@greenbee.net> - 2014-05-23 18:39 +0100
          Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:29 +1000
        Re: Ebay hacked RS Wood <rsw@therandymon.com> - 2014-05-23 21:57 +0000
        Re: Ebay hacked Sylvia Else <sylvia@not.at.this.address> - 2014-05-24 16:28 +1000
      Re: Ebay hacked "James Harris" <james.harris.1@gmail.com> - 2014-05-26 15:27 +0100
        Re: Ebay hacked Rich <rich@example.invalid> - 2014-05-26 14:32 +0000

Page 1 of 3  [1] 2 3  Next page →

#2983 — Ebay hacked

http://www.smh.com.au/it-pro/security-it/ebay-hit-by-cyber-attack-urges-users-to-change-passwords-20140521-zrkiu.html

"EBay also was using a more easily cracked method for protecting the 
passwords it kept on file. There are two commonly used ways to secure 
passwords, encryption and hashing. EBay was using encryption, which is 
the more easily broken, said Mr Coates."

What's the point of recommending strong passwords to users when the 
mechanism used for storing them makes the strength moot?

Why were they using encryption? The hashing approach isn't exactly new 
technology.

When does incompetence become negligence?

Sylvia.

[toc] | [next] | [standalone]

#2988

On Thu, 22 May 2014 17:38:56 +1000
Sylvia Else <sylvia@not.at.this.address> wrote:

> Why were they using encryption? The hashing approach isn't exactly new 
> technology.
> 
> When does incompetence become negligence?
> 
> Sylvia.


Annoyingly, they /still/ haven't bothered to alert me.  Not fun to have
to learn about this stuff in the press first.  A--- would not use again.

[toc] | [prev] | [next] | [standalone]

#3073

RS Wood wrote:

> they /still/ haven't bothered to alert me.

They sent me an email today, my spam filter thought it was spam, and 
when I retrieved it from junk it had a lot of the hallmarks of a 
phishing email.

[toc] | [prev] | [next] | [standalone]

#2992

In message <bu5nskFnom7U1@mid.individual.net> 
  Sylvia Else <sylvia@not.at.this.address> wrote:
> http://www.smh.com.au/it-pro/security-it/ebay-hit-by-cyber-attack-urges-users-to-change-passwords-20140521-zrkiu.html

> "EBay also was using a more easily cracked method for protecting the 
> passwords it kept on file. There are two commonly used ways to secure 
> passwords, encryption and hashing. EBay was using encryption, which is 
> the more easily broken, said Mr Coates."

> What's the point of recommending strong passwords to users when the 
> mechanism used for storing them makes the strength moot?

> Why were they using encryption? The hashing approach isn't exactly new 
> technology.

> When does incompetence become negligence?

Hard to say, but Fleabay has *always* been incompetent.


-- 
>>Trying?
>if you quote yoda, i swear upon everything holy that i will book a  flight to
>okinawa to kick your ass.

[toc] | [prev] | [next] | [standalone]

#3084

Lewis <g.kreme@gmail.com.dontsendmecopies> writes:

> Hard to say, but Fleabay has *always* been incompetent.

Now ebay apparently botched the password reset page too by not allowing
pasting from the clipboard. Ars writes about it at
http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/

I mean really, who wants to type in something like
Q'e-VKj,C6Cz8vWJYnA:U2yz1^m`5GnB? Oh, there's apparently a secret length
limit too.

[toc] | [prev] | [next] | [standalone]

#3085

Anssi Saari <as@sci.fi> wrote:
> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:

> > Hard to say, but Fleabay has *always* been incompetent.

> Now ebay apparently botched the password reset page too by not allowing
> pasting from the clipboard. Ars writes about it at
> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/

That is likely the result of some managerial drone idiot who is
technically incompetent thinking that crooks perform brute force
password search by:

1) using a browser, and;
2) driving the browser via copy&paste

Neither is true, but the managerial drone idiot got to look like he/she
did something useful to the other managerial drone idiots by
"increasing security".

[toc] | [prev] | [next] | [standalone]

#3098

Rich <rich@example.com> writes:

> Anssi Saari <as@sci.fi> wrote:
>> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:
>
>> > Hard to say, but Fleabay has *always* been incompetent.
>
>> Now ebay apparently botched the password reset page too by not allowing
>> pasting from the clipboard. Ars writes about it at
>> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/
>
> That is likely the result of some managerial drone idiot who is
> technically incompetent thinking that crooks perform brute force
> password search by:
>
> 1) using a browser, and;
> 2) driving the browser via copy&paste
>
> Neither is true, but the managerial drone idiot got to look like he/she
> did something useful to the other managerial drone idiots by
> "increasing security".

I think it's driven from the idea that having to type your password
(usually twice) means it will be less likely that you enter the wrong
one and be locked out.  The particular fear I've come across is
preventing cut and paste from the first box to that awful "retype
password" box, thereby propagating a typo.

(I'm not agreeing, just reporting.)

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#3135

On 25/05/2014 5:45 AM, Ben Bacarisse wrote:
> Rich <rich@example.com> writes:
>
>> Anssi Saari <as@sci.fi> wrote:
>>> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:
>>
>>>> Hard to say, but Fleabay has *always* been incompetent.
>>
>>> Now ebay apparently botched the password reset page too by not allowing
>>> pasting from the clipboard. Ars writes about it at
>>> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/
>>
>> That is likely the result of some managerial drone idiot who is
>> technically incompetent thinking that crooks perform brute force
>> password search by:
>>
>> 1) using a browser, and;
>> 2) driving the browser via copy&paste
>>
>> Neither is true, but the managerial drone idiot got to look like he/she
>> did something useful to the other managerial drone idiots by
>> "increasing security".
>
> I think it's driven from the idea that having to type your password
> (usually twice) means it will be less likely that you enter the wrong
> one and be locked out.  The particular fear I've come across is
> preventing cut and paste from the first box to that awful "retype
> password" box, thereby propagating a typo.

Though given that there is almost invariably an automated mechanism for 
recovering from a forgotten password, it's not a valid reason, though 
I'll concede that that may have been the thinking behind it.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#3179

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 5:45 AM, Ben Bacarisse wrote:
>> Rich <rich@example.com> writes:
>>
>>> Anssi Saari <as@sci.fi> wrote:
>>>> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:
>>>
>>>>> Hard to say, but Fleabay has *always* been incompetent.
>>>
>>>> Now ebay apparently botched the password reset page too by not allowing
>>>> pasting from the clipboard. Ars writes about it at
>>>> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/
>>>
>>> That is likely the result of some managerial drone idiot who is
>>> technically incompetent thinking that crooks perform brute force
>>> password search by:
>>>
>>> 1) using a browser, and;
>>> 2) driving the browser via copy&paste
>>>
>>> Neither is true, but the managerial drone idiot got to look like he/she
>>> did something useful to the other managerial drone idiots by
>>> "increasing security".
>>
>> I think it's driven from the idea that having to type your password
>> (usually twice) means it will be less likely that you enter the wrong
>> one and be locked out.  The particular fear I've come across is
>> preventing cut and paste from the first box to that awful "retype
>> password" box, thereby propagating a typo.
> 
> Though given that there is almost invariably an automated mechanism for 
> recovering from a forgotten password, it's not a valid reason, though 
> I'll concede that that may have been the thinking behind it.
> 
> Sylvia.

That's assuming that security chimps can *think*.  I'd assume it's
more of a "monkey see, monkey do" type thing, like the "change your
passwords frequently" mantra. You know, all of the *best practices*
nonsense that gets propagated at the seiminars they attend.

> 

[toc] | [prev] | [next] | [standalone]

#3185

Jerry Peters <jerry@example.invalid> wrote:
> Sylvia Else <sylvia@not.at.this.address> wrote:
> > On 25/05/2014 5:45 AM, Ben Bacarisse wrote:
> >> Rich <rich@example.com> writes:
> >>
> >>> Anssi Saari <as@sci.fi> wrote:
> >>>> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:
> >>>
> >>>>> Hard to say, but Fleabay has *always* been incompetent.
> >>>
> >>>> Now ebay apparently botched the password reset page too by not allowing
> >>>> pasting from the clipboard. Ars writes about it at
> >>>> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/
> >>>
> >>> That is likely the result of some managerial drone idiot who is
> >>> technically incompetent thinking that crooks perform brute force
> >>> password search by:
> >>>
> >>> 1) using a browser, and;
> >>> 2) driving the browser via copy&paste
> >>>
> >>> Neither is true, but the managerial drone idiot got to look like he/she
> >>> did something useful to the other managerial drone idiots by
> >>> "increasing security".
> >>
> >> I think it's driven from the idea that having to type your password
> >> (usually twice) means it will be less likely that you enter the wrong
> >> one and be locked out.  The particular fear I've come across is
> >> preventing cut and paste from the first box to that awful "retype
> >> password" box, thereby propagating a typo.
> > 
> > Though given that there is almost invariably an automated mechanism for 
> > recovering from a forgotten password, it's not a valid reason, though 
> > I'll concede that that may have been the thinking behind it.
> > 
> > Sylvia.

> That's assuming that security chimps can *think*.  I'd assume it's
> more of a "monkey see, monkey do" type thing, like the "change your
> passwords frequently" mantra. You know, all of the *best practices*
> nonsense that gets propagated at the seiminars they attend.

That is likely the true root cause.  The *best pratices* at the
seminars that are espoused as: "do this, and you'll be secure" with
zero time spent to explain why (because explaining why would require
thinking, and well....)

[toc] | [prev] | [next] | [standalone]

#3090

Anssi Saari <as@sci.fi> wrote:
> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:

> > Hard to say, but Fleabay has *always* been incompetent.

> Now ebay apparently botched the password reset page too by not allowing
> pasting from the clipboard. Ars writes about it at
> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/

Actually, PRIMARY selection paste via middle-mouse-button in X-windows
under Linux works just fine, even given ebay's stuipd attempt to block
copy/paste.

But, they are also being extra dumb:

  "Spaces and certain symbols (< >[ ]//) are not allowed in password."

A properly designed password storage (using a hashing function such as
bcrypt or scrypt) does not care what symbols are in the password.

Caring about specific symbols in the password implies they are not
following proper password storage models.

[toc] | [prev] | [next] | [standalone]

#3093

Rich <rich@example.com> writes:

> Anssi Saari <as@sci.fi> wrote:
>> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:
>
>> > Hard to say, but Fleabay has *always* been incompetent.
>
>> Now ebay apparently botched the password reset page too by not allowing
>> pasting from the clipboard. Ars writes about it at
>> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/
>
> Actually, PRIMARY selection paste via middle-mouse-button in X-windows
> under Linux works just fine, even given ebay's stuipd attempt to block
> copy/paste.

Interesting. I just tried changing my password again and in fact both
middle mouse and Ctrl-V paste worked now. Actually one ars comment said
there are two forms so maybe I just got lucky and got the pasting
allowed one? The one I got now also specifies the allowed chars and
length clearly:

"Your password must be 6 to 20 characters long with a combination of at
least 2 of the following: uppercase letters, lowercase letters, numbers
or symbols (!@#$%^*-_+=)."

> Caring about specific symbols in the password implies they are not
> following proper password storage models.

That much has been clear from the start... It would be nice if they
explained what they were doing before and what they're doing now. I'd
guess they're probably doing the same thing they were and maybe planning
something approaching the rudiments of proper storage later or never.

[toc] | [prev] | [next] | [standalone]

#3094

Anssi Saari <as@sci.fi> wrote:
> Rich <rich@example.com> writes:

> > Anssi Saari <as@sci.fi> wrote:
> >> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:
> >
> >> > Hard to say, but Fleabay has *always* been incompetent.
> >
> >> Now ebay apparently botched the password reset page too by not allowing
> >> pasting from the clipboard. Ars writes about it at
> >> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/
> >
> > Actually, PRIMARY selection paste via middle-mouse-button in X-windows
> > under Linux works just fine, even given ebay's stupid attempt to block
> > copy/paste.

> Interesting. I just tried changing my password again and in fact both
> middle mouse and Ctrl-V paste worked now.

When I last tried, the right click -> paste context menu was blocked,
but middle mouse paste worked.  I just presumed ebay had designed a
windows centric block, and therefore X's PRIMARY slipped through their
javascript blockade.

> Actually one ars comment said there are two forms so maybe I just got
> lucky and got the pasting allowed one?

It is also possible that feedback (or pitchforks) from the ARS posting
caused them to quickly modify the form.

> The one I got now also specifies the allowed chars and length
> clearly:

> "Your password must be 6 to 20 characters long with a combination of
> at least 2 of the following: uppercase letters, lowercase letters,
> numbers or symbols (!@#$%^*-_+=)."

> > Caring about specific symbols in the password implies they are not
> > following proper password storage models.

> That much has been clear from the start... It would be nice if they
> explained what they were doing before and what they're doing now. I'd
> guess they're probably doing the same thing they were and maybe planning
> something approaching the rudiments of proper storage later or never.

Sadly, given how many dev's there are that have no idea how to securely
handle password storage, I fear that "never" is more likely when
combined with the phrase "proper storage".

[toc] | [prev] | [next] | [standalone]

#3137

On 25/05/2014 4:33 AM, Rich wrote:

> Sadly, given how many dev's there are that have no idea how to securely
> handle password storage, I fear that "never" is more likely when
> combined with the phrase "proper storage".
>

So we can build a properly secure password system, and sell it for big 
bucks?

No, thought not.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#3147

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 4:33 AM, Rich wrote:

> > Sadly, given how many dev's there are that have no idea how to
> > securely handle password storage, I fear that "never" is more
> > likely when combined with the phrase "proper storage".

> So we can build a properly secure password system, and sell it for
> big bucks?

Actually, we could build it.  But convincing the fools who think they
know what they are doing to instead pay us for ours would be a much
more difficult prospect, I fear.

[toc] | [prev] | [next] | [standalone]

#3193

On 25/05/2014 11:46 PM, Rich wrote:
> Sylvia Else <sylvia@not.at.this.address> wrote:
>> On 25/05/2014 4:33 AM, Rich wrote:
>
>>> Sadly, given how many dev's there are that have no idea how to
>>> securely handle password storage, I fear that "never" is more
>>> likely when combined with the phrase "proper storage".
>
>> So we can build a properly secure password system, and sell it for
>> big bucks?
>
> Actually, we could build it.  But convincing the fools who think they
> know what they are doing to instead pay us for ours would be a much
> more difficult prospect, I fear.
>

Yes, indeed, it was the selling it for big bucks aspect that I was 
expressing doubt about.

And, of course, in the unlikely event that a big-bucks market appeared, 
there'd be competitors offering cheaper products that would be claimed 
to be secure, but would in reality contain the very kind of security 
error that we're seeking to prevent.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#3235

On 2014-05-26, Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 11:46 PM, Rich wrote:
>> Sylvia Else <sylvia@not.at.this.address> wrote:
>>> On 25/05/2014 4:33 AM, Rich wrote:
>>
>>>> Sadly, given how many dev's there are that have no idea how to
>>>> securely handle password storage, I fear that "never" is more
>>>> likely when combined with the phrase "proper storage".
>>
>>> So we can build a properly secure password system, and sell it for
>>> big bucks?
>>
>> Actually, we could build it.  But convincing the fools who think they
>> know what they are doing to instead pay us for ours would be a much
>> more difficult prospect, I fear.
>>
>
> Yes, indeed, it was the selling it for big bucks aspect that I was 
> expressing doubt about.
>
> And, of course, in the unlikely event that a big-bucks market appeared, 
> there'd be competitors offering cheaper products that would be claimed 
> to be secure, but would in reality contain the very kind of security 
> error that we're seeking to prevent.

It's quite a few years ago but I remember telling a family member to get an
antivirus package and mentioned some likely candidates.  They came back to
me saying that they had bought the Norton offering instead because they
"felt safer with a big name".

Oh well...

-- 
Paul Sture

The final step of #heartbleed recovery is to call your mother, and advise
her to change her maiden name                                  -- @gojomo

[toc] | [prev] | [next] | [standalone]

#3283

On 2014-05-24, Anssi Saari <as@sci.fi> wrote:
> Rich <rich@example.com> writes:
>
> Interesting. I just tried changing my password again and in fact both
> middle mouse and Ctrl-V paste worked now. Actually one ars comment said
> there are two forms so maybe I just got lucky and got the pasting
> allowed one? The one I got now also specifies the allowed chars and
> length clearly:
>
> "Your password must be 6 to 20 characters long with a combination of at
> least 2 of the following: uppercase letters, lowercase letters, numbers
> or symbols (!@#$%^*-_+=)."

That is more or less the top row of a US keyboard:

unshifted: 1234567890-=
shifted:   !@#$%^&*()_+

note that the ampersand is missing in the text you gave.

-- 
Paul Sture

The final step of #heartbleed recovery is to call your mother, and advise
her to change her maiden name                                  -- @gojomo

[toc] | [prev] | [next] | [standalone]

#3115

In message <llqipl$59h$1@dont-email.me> 
  Rich <rich@example.com> wrote:
> Anssi Saari <as@sci.fi> wrote:
>> Lewis <g.kreme@gmail.com.dontsendmecopies> writes:

>> > Hard to say, but Fleabay has *always* been incompetent.

>> Now ebay apparently botched the password reset page too by not allowing
>> pasting from the clipboard. Ars writes about it at
>> http://arstechnica.com/security/2014/05/after-the-breach-ebays-flawed-password-reset-leaves-much-to-be-desired/

> Actually, PRIMARY selection paste via middle-mouse-button in X-windows
> under Linux works just fine, even given ebay's stuipd attempt to block
> copy/paste.

> But, they are also being extra dumb:

>   "Spaces and certain symbols (< >[ ]//) are not allowed in password."

> A properly designed password storage (using a hashing function such as
> bcrypt or scrypt) does not care what symbols are in the password.

> Caring about specific symbols in the password implies they are not
> following proper password storage models.

Of course they aren't.



-- 
Major Strasser has been shot. Round up the usual suspects.

[toc] | [prev] | [next] | [standalone]

#3136

On 25/05/2014 2:53 AM, Rich wrote:

>
>    "Spaces and certain symbols (< >[ ]//) are not allowed in password."
>
> A properly designed password storage (using a hashing function such as
> bcrypt or scrypt) does not care what symbols are in the password.
>
> Caring about specific symbols in the password implies they are not
> following proper password storage models.
>

I wonder where the restriction is enforced - both on the client and at 
the server, or just in the client? How many here would be surprised if 
it were the latter?

Sylvia.

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.misc

csiph-web