Suggestions for the Forum

Here are a couple of ideas for the Forum:

1. Create a subforum that covers topics (like this very message) that relate to the Forum itself.

2. In checking password validity, consider both the presented password and the same password with the CapsLock key inverted. That would be a convenience for the absent-minded without noticeably impacting security -- a factor of 2 in guesswork isn't worth much.

1. Create a subforum that covers topics (like this very message) that relate to the Forum itself.

It already exists and its called LQ Suggestions & Feedback, which is where this thread will be moved.

Thread moved as per Reddazz's spooky prediction.

Your password idea, wouldn't that be of great help to other people trying to guess your password?

Originally Posted by XavierP Thread moved as per Reddazz's spooky prediction. Your password idea, wouldn't that be of great help to other people trying to guess your password?

Not really. Even with smart guessing, the number of possible passwords is so large that reducing it by a factor of 2 wouldn't help much.

Just the requirement of a 15-minute wait after 5 wrong guesses will defeat any exhaustive-search method. if someone can reduce the number of possible passwords to, say 20, it's not much harder to make 40 guesses as 20 guesses.

Am I missing something with that factor of 2 bit? If you just stick to case insensitive letters and (for example) a 6 character password the number of possiblities is 26x26x26x26x26x26 = 308,915,776. If you have case sensitive passwords you double the possibilities for each letter (not just the overall) which is 52x52x52x52x52x52 = 19,770,609,664

As indicated, #1 exists. We have no plans to implement anything similar to #2. The way your password is encrypted in the database, it wouldn't even be possible. Thanks for the feedback.

--jeremy

I guess I wasn't clear about my proposal. Capslock inverts all letters, both lowercase and uppercase. Suppose I have the password AbcDe. Then the password aBCdE and no other is also legitimate. So the number of guesses is halved but not reduced by more than that since every password has exactly one acceptable equivalent.

I wonder how many people have passwords that are guessable without brute force. Even assuming a naive user and a foolish password choice, there might be 20 or 30 obvious possibilities, and everything beyond those would require brute force - even a dictionary attack.

Dictionaries are vicious attackers which exert brute force. My big toe remembers one attack that happened last week. Unfortunately that was not the CD version of the Harraps dictionary.

Originally Posted by samael26 Dictionaries are vicious attackers which exert brute force. My big toe remembers one attack that happened last week. Unfortunately that was not the CD version of the Harraps dictionary.

Thesauruses (thesauri?) are worse, they bite!

My idea about capslock and passwords reminded me of a thought I had about ATM machines. Probably most people have had the experience of inserting the card the wrong way and not realizing for a moment why it doesn't work. Could it be that hard (or expensive) to design ATM machines so that they work no matter what the orientation of the inserted card (with multiple sensors, presumably)?

It would be good, but only outside Europe. We lovely Yoorpeens have chip and pin and a little gold (at least in the UK) chip at one end of the card.

Originally Posted by pwabrahams I guess I wasn't clear about my proposal. Capslock inverts all letters, both lowercase and uppercase. Suppose I have the password AbcDe. Then the password aBCdE and no other is also legitimate. So the number of guesses is halved but not reduced by more than that since every password has exactly one acceptable equivalent. I wonder how many people have passwords that are guessable without brute force. Even assuming a naive user and a foolish password choice, there might be 20 or 30 obvious possibilities, and everything beyond those would require brute force - even a dictionary attack.

I don't know of any website that allows incorrect caps with passwords- they're always case-sensitive. However, LQ, just like the rest, has a link to click if you've forgotten your password, so you really don't have to keep guessing. My personal solution- I don't log out.

EDIT: As a side note, it would also be much easier to add a routine so that ABCDE, abcde, etc. would also work, rather than just the inverse of the correct values.

Cheers

or remind people (like windows, ugh) that they may have their capslock key on- but that's something I check first when I don't put my password in correctly.


TG

Originally Posted by titanium_geek or remind people (like windows, ugh) that they may have their capslock key on- but that's something I check first when I don't put my password in correctly. TG

ROFL
That was a real pet-peeve for me with windows- always treating you like a total idiot. I didn't appreciate the need to click through 2+ layers of confirmation to get it to follow instructions. Linux, on the other hand, expects you to know what you're doing, or be willing to figure out what you did wrong and fix it.

BTW- Is anyone still looking for the 'ANY' key??

Originally Posted by dragonslayer48dx ROFL That was a real pet-peeve for me with windows- always treating you like a total idiot. I didn't appreciate the need to click through 2+ layers of confirmation to get it to follow instructions. Linux, on the other hand, expects you to know what you're doing, or be willing to figure out what you did wrong and fix it.

I agree in general that systems like Windows that try to guess what you meant and get it wrong all too often are a pain in the butt. But in this particular context there's little to be lost, assuming my view of the security issue is correct.

The question of whether Linux should expect you to know what you're doing goes to the heart of a controversial issue: is Linux supposed to be a replacement for Windows for all users or only for sophisticated users? If Linux is supposed to be usable by people of average intelligence with no particular interest in computers, then perhaps Linux shouldn't make that assumption. If you assume a sophisticated user, then it should. Is Linux intended to be a system for the masses, or not?