Thread: Password Management.

Originally Posted by Veovis

Is brute force even a realistic way for somebody to get your PW? Most systems I use lock you out after a couple failed attempts. I would think even those that don't do it by default would somehow fail on the server after a few hundred/thousand/million attempts.

Right the lockout is the key, to make you paranoid, yes. A skilled cracker, with the incentive can take down any wall, time is just the question (for all system that have a door of anysort, not applicable to CC systems without direct/indirect access). Even with system lockouts, a skilled cracker would go the route of a daemon army (compromised computers of every day folk) IF he was, for whatever reason, going the brute route; the lockouts do hinder the process, but can be negated.

However, for the 99% of the kiddy scripters, who used prebuilt tools and have no idea how they work. Dont even give it a second though for systems that have lockouts. Bruting for majority of systems damn near almost always the hardest, and longest road to take.

Social engineering is the best way and the fastest.... Be aware people be very aware...

My stupid online bank allows special characters in the username... but the password is only alphanumeric, and get ready for it... 8 characters max. How stupid is that? Why would they let the username be more complex than the password?