Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think the point here is that if goofy capitalization is the only thing that kept your password from being trivially guessable, your password was only a little bit harder to guess. If your password isn't guessable, then it doesn't really matter if you have additional entropy, because the server smacks down brute-force attempts before they even get off the ground. In other words, it doesn't seem like capital letters make your password appreciably more secure in this context.


That's exactly the problem here. A typical user who adds capitalization to make her password more difficult to guess is basically screwed over by Blizzard who has decided that passwords don't need to be case-sensitive.

Users who opt to (I'm not talking about forcing users to use capitalization here) to use capitalization for a more secure password are unaware that their efforts are in vain.

Also, it isn't only trivially more guessable. That's nonsense. If you're using a password list and you capitalize only the first letter of every password in that list, that list is still double the size of the first list.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: