Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test

Since I am a decent fan of the XKCD no 936 (or actually conclusions and implications it brings), I wanted to test (using try zxcvbn) the complexity and the possiblity of breaking a password like the following one:

My password for Facebook… Continue reading Why removing just one letter form passwords makes it 20x easier to break according to zxcvbn test

Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?

Assume that I never check the server fingerprint when logging in to an SSH server. This means that certain configurations of SSH can be impersonated. For example, I can log into a server that only has my public key. Obviously this doesn’t … Continue reading Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?

The top 200 most common passwords in 2022 are bad, mkay?

According to NordPass’ latest list of top 200 most common passwords in 2022, “password” is the most popular choice, followed by “123456”, “123456789”, “guest” and “qwerty“. 2022 is endin… Continue reading The top 200 most common passwords in 2022 are bad, mkay?

Should a bank be able to shorten your password without your involvement?

The bank of a friend changed password policy, such that you are limited to 20 characters. However, he used 24 letters before and thus was not able to log in anymore.
He called his advisor, who suggested, he should try to log in with the fi… Continue reading Should a bank be able to shorten your password without your involvement?