said by Mele20 :

What's "PBEKAC"?

said by Mele20 :

The problem with long passwords, and especially all those numbers, is that you can't see what you are typing. Way too easy to transpose numbers. I'd probably type that a dozen times and never get it right and some sites only allow three attempts. I only use complex passwords for banking sites and didn't do it for them until recently.

There is no reason to x out passwords on the screen if the user isn't somewhere that others look over his shoulder or take photos from a distance. I always have wondered why that is done. That should be something that a user turns on if they need it otherwise what you are typing should show up on the screen. I'm always mistyping a password, even one that is not complicated and that I have typed many times, and it irritates me that I can't tell what I am typing.

said by Doctor Four :

The MySpace crowd aren't really all that security savvy
to begin with.

said by Drunkula :

Actually I never heard of ROT-26 but wouldn't that be the same as not encoding it at all?

said by ZOverLord :

If everyone ran a bot for research, would there be any hackers?

Be careful, there are laws that say what your did was illegal, depending on where you were located, and a "Paris Hilton" defense these days, won't help much, and you did get real logons and passwords ;-)

said by EGeezer :

I'm thinking about using dictionary passwords, but encrypted in ROT-26. Twice as secure as ROT-13 ...

said by angussf :

IIWY I would get some sort of encrypted password store instead of a text file. I use a Palm device, so I use YAPS with the YAPSviewer program on my desktop that allows me to cut-and-paste from the datastore. There are other packages, including OSS ones like KeePass Password Safe
»keepass.info/ so cost shouldn't be a concern here. That way you memorize ONE long complex password (to the password database) and look up all the rest, yet if someone steals your computer / laptop / PIM device, you haven't lost anything.

said by NetWatchMan :

*I* was not running a phishing site...the malware, the botnet, and the miscreant were...I only allowed it to be active for a short period of time....the only reason I let it run for 12 hours was I thought it wasn't doing anything.

My goals are not "research" oriented...unfortunately, I can't elaborate on that point.

I agree that these tactics push the envelope but believe they are essential to countering cybercrime.

said by David :

Well if I may offer this little diblet this is the best password generator I have seen and seems to work rather well.

»www.pctools.com/guides/password/

Now there is no excuse as to why the myspace croud can't create a more complex password.

said by Doctor Four :

The MySpace crowd aren't really all that security savvy
to begin with. So encountering this is not surprising
in the least.

said by caffeinator :

I have a textfile for the really long ones like banking and Paypal.

said by aaron8301 :

But it's VERY hard for a MySpace phishing bot to get the password from the yellow sticky note on the side of your monitor.

The problem with long passwords, and especially all those numbers, is that you can't see what you are typing.

said by C DM :

So is it considered OK to run phishing sites and/or use botnets (even if they are for "research" purposes)?

said by 8744675 :

Somewhere I heard that the most commonly used password is 'password', and I believe it.

said by alanhdsl :

Those may be good passwords, but now you're inviting a yellow sticky note with "3REfrure" written on it.

The challenge is that good passwords are hard to remember, so people either pick simple ones and/or write them down. I'm not sure there's a good solution.

said by C DM :

So is it considered OK to run phishing sites and/or use botnets (even if they are for "research" purposes)?

said by FiL :

Its friggin' myspace tho...

How much damage can be done through that shitty ass service? Maybe PS a few pics, steal email addy, bla bla...most of the people that logon in my experience use throw away email addys.

said by NetWatchMan :

Use dictionary words with a numeric suffix (preferable a "1")!

(Shakes head in disgust)

said by NetWatchMan :

Hey I know we have a global security problem, but this brings my impression of just how bad it is to an even lower low.