I can tell when I’m being phished if my password works on the first try
Step 1: find phishing site
Step 2: find/write brute force script that doesn't stop on successful login but has longer random delay between attempts (so it isn't obvious it's a form of a DOS attack)
Step 3: poison phishing site dataUse proxies from areas that would normally use the service the phishing site is mimicking.
Bonus step: in case the phishers use the same proxies source, make enough invalid login attempts to the actual service to get the proxies IP blocked so they can't use them to test the large number of invalid logins to find if any are valid.
I want to do this now...
- Try to log in to my ISP's website. "Username not found."
- Try the password reset link and put in the username just to see what happens. "Password reset email sent."
- Email turns up. Click the link. Type a password. "Password reset successfully."
- Try to log in to my ISP's website. "Username not found."
Edit: to be clear, I didn't put in my email address, I only put in the username. The system looked up the username and found the email address by itself.
They have nothing better to do than store a decade's worth of password hashes so that every 90 days I have to come up with a completely new password that's somehow magically different enough from every other password I've come up with in the past 10 years and is at least 10 characters from each of the 4 holy categories.
This can occur when you're entering the correct password, but there is a typo in the username you entered. Nobody spellchecks the username.
It can also happen if your password expired. Active Directory is infamous for just locking accounts if your user doesn't change their password when they get the popup that it expired
My current employer has the worst password policies of anywhere I’ve ever worked. I hate it. It’s insane. I know I can install a password manager, but the one that’s approved isn’t the one I want to use so I just suffer.
I’ve been in tech for decades now, so the above statement (worst ever) is truly horrific to me. Especially given that the job is so great otherwise and I don’t want to move on.
Must have lowercase, uppercase, numbers, symbols, minimum of 5 chars, max of 8. No dictionary words, no reusing characters (one char instance only), no numbers in order (123), no letters in order (abc nor qwe), nor in descending order (987, mnb). Caps lock is a unique character that must be used. Password expiration every 28 days. Cannot reuse old passwords, remembers last 10 passwords. Cannot add a number or letter at the end that causes an ascending or descending pattern. Password field cannot be pasted into.
minimum of 5 chars, max of 8
That's bizarre. I've never seen such a narrow runway for password length. Sounds like hell for sure.
That pretty much narrows it down to MonthYear!
Brutal truth: You entered it wrong that many times.
Yes, really.
No, I know: It's crazy.
Did you have capslock on?
Edit: lol, I get the angry downvotes but I promise you this happens all the time
That or you just being obligated to change your password.
I've once had a user who managed to add a second keyboard layout by accident and switch to it on login. I found out when I reset his password and it still didn't work on the laptop of the users even if I typed it in myself.
Don't get me started on captchas
