Don’t get me started on captchas
My old job did this.
“Oh Monkeybutthair01,02,03 has already been used…Monkeybutthair04 it is.”
password updatedSECURITY. 👍👍
Sometimes I wonder if they’re doing it now to push passkeys
Nah; this shit has been a thing since forever.
- Try to log in to my ISP’s website. “Username not found.”
- Try the password reset link and put in the username just to see what happens. “Password reset email sent.”
- Email turns up. Click the link. Type a password. “Password reset successfully.”
- Try to log in to my ISP’s website. “Username not found.”
I can tell when I’m being phished if my password works on the first try
Step 1: find phishing site
Step 2: find/write brute force script that doesn’t stop on successful login but has longer random delay between attempts (so it isn’t obvious it’s a form of a DOS attack)
Step 3: poison phishing site dataUse proxies from areas that would normally use the service the phishing site is mimicking.
Bonus step: in case the phishers use the same proxies source, make enough invalid login attempts to the actual service to get the proxies IP blocked so they can’t use them to test the large number of invalid logins to find if any are valid.
I want to do this now…
Ok, that’s pretty funny. Nicely done
They have nothing better to do than store a decade’s worth of password hashes so that every 90 days I have to come up with a completely new password that’s somehow magically different enough from every other password I’ve come up with in the past 10 years and is at least 10 characters from each of the 4 holy categories.
This can occur when you’re entering the correct password, but there is a typo in the username you entered. Nobody spellchecks the username.
It can also happen if your password expired. Active Directory is infamous for just locking accounts if your user doesn’t change their password when they get the popup that it expired
My current employer has the worst password policies of anywhere I’ve ever worked. I hate it. It’s insane. I know I can install a password manager, but the one that’s approved isn’t the one I want to use so I just suffer.
I’ve been in tech for decades now, so the above statement (worst ever) is truly horrific to me. Especially given that the job is so great otherwise and I don’t want to move on.
Must have lowercase, uppercase, numbers, symbols, minimum of 5 chars, max of 8. No dictionary words, no reusing characters (one char instance only), no numbers in order (123), no letters in order (abc nor qwe), nor in descending order (987, mnb). Caps lock is a unique character that must be used. Password expiration every 28 days. Cannot reuse old passwords, remembers last 10 passwords. Cannot add a number or letter at the end that causes an ascending or descending pattern. Password field cannot be pasted into.
That pretty much narrows it down to MonthYear!
minimum of 5 chars, max of 8
That’s bizarre. I’ve never seen such a narrow runway for password length. Sounds like hell for sure.
Brutal truth: You entered it wrong that many times.
Yes, really.
No, I know: It’s crazy.
Did you have capslock on?
Edit: lol, I get the angry downvotes but I promise you this happens all the time
I’ve once had a user who managed to add a second keyboard layout by accident and switch to it on login. I found out when I reset his password and it still didn’t work on the laptop of the users even if I typed it in myself.
That or you just being obligated to change your password.
Yeah, this. There are sites for some maddening reason that don’t bother to tell you it’s time to change your password, they just force you to reset it without telling you why. Gotta be some kind of lazy shortcut to do it this way and not prompt the user that a password change is required.
It’s frustrating but it does give information to attackers. If an attacker just sees the login attempt was rejected, then they have no idea if it was because the password changed, the user entered it wrong in the phishing form, the user realized it was a phishing attempt and gave garbage to fuck with them, the password expired, or if the service provider is on to them.
If an attacker sees “your password has been reset and you must set a new one” then they have some information that could be used to social engineer their way into the account. Especially if it’s a work account where the email is behind the same password.
Maybe it was just time, maybe your password got scrambled because your account was compromised: They’ll never tell!
Maybe for some. Government sites that I use do this deliberately (not accept your current password) to make you change it. Pretty frustrating the first few times it happened, but now I know that when this happens it’s because of a password change requirement. It’s been years and they still haven’t just made a “time to change” prompt.
It’s pretty common in general but at least some of them actually do you the courtesy of letting you know.
