That's been the most frustrating thing about using a password manager.
I set the random generator pretty high and have to reset and decrease it randomly until the login works.
That means they've updated their password requirements and your new one is now rejected, or they reject passwords of a certain age or with a lack of account activity.
They better not know whether the old password matches their new password requirements, as all they should have is the salted hash of the password, which reveals no information about the password on its own.
That's because you've been rate limited trying passwords for an hour. When an attacker is randomly trying incorrect passwords, even the correct password will be rejected. Otherwise the protection wouldn't be very useful.
Bug report: “The ‘reset password’ form doesn’t show an error if you try to reset an account that doesn’t exist.”
Me: “That would be a security risk. Closed.”
Them: “What? How? You have to click the link in the email before it does anything.”
Me: “Try putting in a bogus email on the login screen. See how it says ‘wrong email/password combination’, and not ‘no such account’? If we tell the user whether we recognize a given email, we’re basically providing attackers a list of users they can try passwords for.”
They keep multiple old passwords. You've done this whole stick before and you tried to use that same password last time. You use it for everything, and every time your new account gets "hacked." You keep using that password even when we show you that it's been in multiple leeks and is associated with your email.
"But I like the password, it's my favourite football team!"
There's few things more violently infuriating than being told that.... You fucking told me it was the wrong password in the first place for fuck sake, I only have 3 fucking password variants I use, but noooo you need a brand new, never before used by any human ever, password. Fuck you web developers!
I've always thought that the best password security possible would be to always have the real password fail a few times. People who know their password will keep trying it, someone else will try a different one. It's a variation of not giving an error that tells what failed.
I used to spoof the login page of my campus freenet, fail the first login, store the password and then jump to the actual page. End of the day I just go around the lab harvesting.
I'm more pissed that they are keeping all my old passwords... So when they get leaked, they all get leaked.
Meanwhile, all our phones have cameras but we can't have them take a pic on the wrong pin entered because why? No logic in Emailing the picture to you. That's just silly.
28 Comments
magic_lobster_party@fedia.io · 49 pts · 334d
One way this happened to me was because the ” choose password” page silently truncated too long passwords. The login page didn’t truncate.
helpImTrappedOnline@lemmy.world · 24 pts · 333d
That's been the most frustrating thing about using a password manager. I set the random generator pretty high and have to reset and decrease it randomly until the login works.
Sabata11792@ani.social · 8 pts · 333d
When the shitty site dose not allow half the special characters in the generated password...
candyman337@lemmy.world · 20 pts · 334d
That means they've updated their password requirements and your new one is now rejected, or they reject passwords of a certain age or with a lack of account activity.
pelespirit@sh.itjust.works · 5 pts · 334d
I'm pretty sure it was because the password was compromised. That's what I've heard for a decade now.
coffee_tacos@mander.xyz · 4 pts · 333d
They better not know whether the old password matches their new password requirements, as all they should have is the salted hash of the password, which reveals no information about the password on its own.
candyman337@lemmy.world · 3 pts · 333d
Well, that's best practices but that's definitely not always implemented lmao
lvxferre@mander.xyz · 16 pts · 333d
Thorry@feddit.org · 9 pts · 334d
That's because you've been rate limited trying passwords for an hour. When an attacker is randomly trying incorrect passwords, even the correct password will be rejected. Otherwise the protection wouldn't be very useful.
kibiz0r@midwest.social · 6 pts · 333d
Had a convo with someone a while back:
Bug report: “The ‘reset password’ form doesn’t show an error if you try to reset an account that doesn’t exist.”
Me: “That would be a security risk. Closed.”
Them: “What? How? You have to click the link in the email before it does anything.”
Me: “Try putting in a bogus email on the login screen. See how it says ‘wrong email/password combination’, and not ‘no such account’? If we tell the user whether we recognize a given email, we’re basically providing attackers a list of users they can try passwords for.”
SoaringDE@feddit.org · 1 pts · 333d
But then there would be no harm in just stating the rate limit :(
bathing_in_bismuth@sh.itjust.works · 8 pts · 333d
And why keep hashes (I fucking hope so) of old passwords?
BlueMagma@sh.itjust.works · 8 pts · 333d
To be able to display this error message and force you to use a different password, that way you won't remember it.
purplemonkeymad@programming.dev · 6 pts · 333d
They keep multiple old passwords. You've done this whole stick before and you tried to use that same password last time. You use it for everything, and every time your new account gets "hacked." You keep using that password even when we show you that it's been in multiple leeks and is associated with your email.
"But I like the password, it's my favourite football team!"
maus@sh.itjust.works · 3 pts · 333d
Not so fun, fun fact. Google does not let you re-use the last 100 passwords.
explodicle@sh.itjust.works · 2 pts · 333d
Bruh I never wanted to log in just to use your system. Just let me use "password".
Chingzilla@lemmy.world · 5 pts · 333d
Relevant Tom Carty
https://www.youtube.com/watch?v=5DtPkr8yJ00
TheInfamousOne@lemmy.world · 3 pts · 333d
Also, Relevant CalebCity
https://www.youtube.com/watch?v=u92RWKB3CR4
dumbass@aussie.zone · 4 pts · 334d
There's few things more violently infuriating than being told that.... You fucking told me it was the wrong password in the first place for fuck sake, I only have 3 fucking password variants I use, but noooo you need a brand new, never before used by any human ever, password. Fuck you web developers!
TheRealKuni@piefed.social · 4 pts · 333d
I used to live that life. It’s a dangerous one. Consider a password manager.
Rhaedas@fedia.io · 4 pts · 334d
I've always thought that the best password security possible would be to always have the real password fail a few times. People who know their password will keep trying it, someone else will try a different one. It's a variation of not giving an error that tells what failed.
JeeBaiChow@lemmy.world · 5 pts · 334d
I used to spoof the login page of my campus freenet, fail the first login, store the password and then jump to the actual page. End of the day I just go around the lab harvesting.
TheRealKuni@piefed.social · 3 pts · 333d
To what end? What benefit was there in having people’s campus logins?
JeeBaiChow@lemmy.world · 2 pts · 333d
Can't imagine. Give me your bank login credentials and I'll let you know.
tekeous@beehaw.org · 3 pts · 333d
This is delightfully evil
GreenShimada@lemmy.world · 3 pts · 334d
Your hatred is steaming beans?
My hatred usually corns beef.
diptchip@lemmy.world · 2 pts · 333d
I'm more pissed that they are keeping all my old passwords... So when they get leaked, they all get leaked. Meanwhile, all our phones have cameras but we can't have them take a pic on the wrong pin entered because why? No logic in Emailing the picture to you. That's just silly.
chicken@lemmy.dbzer0.com · 13 pts · 333d
In theory they could be only storing the hash and using that to determine if you reused an old one
TheRealKuni@piefed.social · 4 pts · 333d
This is what’s happening, if they’re even a little bit good at their jobs.