Yeah, stupid autocorrect. And verifying ain’t the same as doing. I’ll come in, I’ll “sort” your data, and I’ll do it damn fast. You want verification that’s extra!
but how do you know you are done. maybe there are different ideas of what bogo sort is, but as i remember, it is basically a while true (or while false loop) with condition - while list_is_not_sorted { return_a_random_ordering }
Even worse the silent invalidation of a correct password.
Use password manager.
Can't log in, because "password is incorrect"...
Fuck you! It is not! I copied in the same fucking thing as months before! If you want to force me to change it then say it! Asshole!
It rejects the first [correct] login attempt (it’s worded poorly). It assumes that a brute force attacker will try any given password once and move on, while a human user will think they made a typo and try again. This works until the attacker realizes that it takes two attempts, in which case it merely doubles the attempts required to breach the account, and simply requiring an additional password character would be vastly more effective.
Agreed, and also makes it readily known that that is what you are doing.
The sneakier more user friendly way to implement it would be to require the second correct attempt only if the user has made an incorrect attempt since the last successful login.
All tools that bruteforce passwords attempt each password only once, and if it doesn't work, discard it. Nobody really runs 2 identical attacks back to back (they're incredibly slow when done over the internet), so the password would seem uncrackable at first glance.
This approach wouldn't work with hash cracking, vault breaking or file encryption, because once they get their hands on the hash/vault/file, the attacker can use their own code for hashing/checking a password candidate.
It doesn't.
Cracking programs don't use the user login form repeatedly. They use the same algorithm that creates the publicly encoded password to generate encoded passwords and keep going until they have a match. Besides getting the encoded password and salt, everything is done offline.
39 Comments
db2@lemmy.world · 170 pts · 286d
isFirstSuccessfulLoginAttempt
Important distinction.
dalekcaan@feddit.nl · 35 pts · 286d
Yeah, as it is it only works if the brute force algorithm gets it on the first try.
atopi@piefed.blahaj.zone · 13 pts · 286d
Or the variables are terribly named
Jimbabwe@lemmy.world · 4 pts · 286d
Boho sort is O(1) in the best case scenario
sga@piefed.social · 1 pts · 285d
i guess you mean bogo sort? just verifying that output is sorted requires O(n). In Quantum bogo sort, you can skip verification.
Jimbabwe@lemmy.world · 2 pts · 285d
Yeah, stupid autocorrect. And verifying ain’t the same as doing. I’ll come in, I’ll “sort” your data, and I’ll do it damn fast. You want verification that’s extra!
sga@piefed.social · 2 pts · 285d
but how do you know you are done. maybe there are different ideas of what bogo sort is, but as i remember, it is basically a while true (or while false loop) with condition - while list_is_not_sorted { return_a_random_ordering }
Jimbabwe@lemmy.world · 1 pts · 285d
Yeah but I said in the best case. In the best case, your randomization is correct so you don’t need to check it
TheseusNow@lemmy.zip · 1 pts · 285d
Not even then. Brute force cracking programs don't rely on the server to indicate if the attempted password is correct.
Simulation6@sopuli.xyz · 0 pts · 286d
No, it just means you have to type in the correct password twice in a row.
funkless_eck@sh.itjust.works · 5 pts · 286d
Johanno@feddit.org · 40 pts · 286d
Even worse the silent invalidation of a correct password.
Use password manager.
Can't log in, because "password is incorrect"... Fuck you! It is not! I copied in the same fucking thing as months before! If you want to force me to change it then say it! Asshole!
mckean@programming.dev · 5 pts · 285d
sorry, but your new password cannot be the same as your current one.
falseWhite@lemmy.world · 19 pts · 286d
snooggums@piefed.world · 17 pts · 286d
How does this 'kinda work'?
MyTurtleSwimsUpsideDown@fedia.io · 80 pts · 286d
It rejects the first [correct] login attempt (it’s worded poorly). It assumes that a brute force attacker will try any given password once and move on, while a human user will think they made a typo and try again. This works until the attacker realizes that it takes two attempts, in which case it merely doubles the attempts required to breach the account, and simply requiring an additional password character would be vastly more effective.
snooggums@piefed.world · 40 pts · 286d
What a shitty user experience for regular users.
dreadbeef@lemmy.dbzer0.com · 100 pts · 286d
which is why they made a comic instead of a revolutionary thought leading blog post
taiyang@lemmy.world · 15 pts · 286d
Hey now, I'm sure there's someone on LinkedIn suggesting this exact thing with layers of corporate speak.
ICastFist@programming.dev · 17 pts · 286d
Just like captcha
MyTurtleSwimsUpsideDown@fedia.io · 16 pts · 286d
Agreed, and also makes it readily known that that is what you are doing.
The sneakier more user friendly way to implement it would be to require the second correct attempt only if the user has made an incorrect attempt since the last successful login.
petersr@lemmy.world · 4 pts · 286d
Look, we all need to pay a little for the greater good of security.
/s
Smoogs@lemmy.world · 4 pts · 286d
Yup it’s like how software companies will get a hate on for pirates and take it out on their loyal paying cutosmers
black0ut@pawb.social · 23 pts · 286d
All tools that bruteforce passwords attempt each password only once, and if it doesn't work, discard it. Nobody really runs 2 identical attacks back to back (they're incredibly slow when done over the internet), so the password would seem uncrackable at first glance.
This approach wouldn't work with hash cracking, vault breaking or file encryption, because once they get their hands on the hash/vault/file, the attacker can use their own code for hashing/checking a password candidate.
Kolanaki@pawb.social · 6 pts · 286d
They'll change the correct password every time because they are told it is wrong.
MonkeMischief@lemmy.today · 2 pts · 286d
Don't worry, a not-insignificant number of users probably use "Forgot Password?" every time because they can't keep track of the correct one. Lol
I suspect this is why we started to see all those "use a temporary password instead" options lately. XD
TheseusNow@lemmy.zip · 5 pts · 285d
It doesn't. Cracking programs don't use the user login form repeatedly. They use the same algorithm that creates the publicly encoded password to generate encoded passwords and keep going until they have a match. Besides getting the encoded password and salt, everything is done offline.
This just creates a really bad user experience.
camelbeard@lemmy.world · 2 pts · 285d
If they actually use the real login form, most websites block an account after X attempts. Sometimes for 1-24 hours, sometimes until you do a PW reset
laserm@lemmy.world · 9 pts · 285d
At least make it
if !isPasswordCorrect || isFirstTrySamskara@sh.itjust.works · 0 pts · 285d
guard isFirstAttempt { return LoginError(); }
blockheadjt@sh.itjust.works · 8 pts · 285d
Center guy's hair got visibly lighter from the stress
Septimaeus@infosec.pub · 5 pts · 286d
accideath@feddit.org · 19 pts · 286d
You are very confident in your ability to not make a typo.
sznowicki@lemmy.world · 15 pts · 286d
How to make a typo when using password manager?
I tell you how. Password manager fills the input just a bit too fast so that misused react handler goes into race condition and skips last character.
CyberEgg@discuss.tchncs.de · 4 pts · 286d
You're still typing PWs? I c&p them from Keepass.
accideath@feddit.org · 1 pts · 286d
I prefer a password system that I can memorise or derive.
Although, fair, I do also use a pm.
bleistift2@sopuli.xyz · 1 pts · 286d
How do you log on to your computer?
CyberEgg@discuss.tchncs.de · 1 pts · 286d
On my last job we had fingerprint scanners for that.
TommyJohnsFishSpot@lemy.lol · 1 pts · 286d
Memorize the disk encryption password, memorize the keepass database password.... wallah
Septimaeus@infosec.pub · 1 pts · 286d
the_grass_trainer@lemmy.world · 2 pts · 285d
Is this Tron: Ares?
thatradomguy@lemmy.world · 2 pts · 285d
The only part that works is that I get to keep my trust issues.
MamaSharon@lemmy.world · -2 pts · 285d