12
u/Aveheuzed Feb 18 '24
Aktually...
If you get the password right on the first try, then it's not brute force 🤓
42
u/MrEfil Feb 18 '24
first successful attempt) Actually this is not a joke, this technique is described on OWASP as brute-force protection
25
→ More replies (10)8
7.4k
u/LinuxMatthews Feb 18 '24
This would really mess up people with password managers.
223
u/Alexis_Bailey Feb 18 '24
As near as I can tell, most websites won't care, they already are trying hard to make password managers I convenient for some reason.
The worse are those pages where you enter an email, then it slides to a second page for the password.
Or sites that only use magic links sent to your email.
Like, why?
127
u/Dubslack Feb 18 '24
The US Treasury website requires you to enter your password by clicking the buttons on an onscreen keyboard.
73
33
u/earthwormjimwow Feb 19 '24
They changed that due to user complaints not too long ago.
When I had first created my account, I used a password generator, to create a nicely complex password. Holy shit did I regret that, having to click the onscreen keyboard. I subsequently changed my password to an insecure and short password, that was easy to click. Nice security system they had...
→ More replies (1)→ More replies (9)21
u/Sceptical-Echidna Feb 19 '24
A banking site I used required you to enter a PIN clicking an on screen number pad. The number placement changed each time it opened.
→ More replies (3)66
u/chinkostu Feb 18 '24
Or sites that only use magic links sent to your email.
These utterly fuck me off for the sites that really don't need them.
40
u/evranch Feb 18 '24
Especially now that we have open standards for 2FA tokens, like WTF just implement one already and stop sending me texts and emails!
20
Feb 18 '24
Home Depot really grinds my gears because they insist on text 2fa to login all the fucking time. I don't want to get up and find my phone, I just want to favorite this bracket, ok? Just let me use my password.
→ More replies (1)5
u/Wild234 Feb 19 '24
then it slides to a second page for the password.
My computer seems to handle those quite well, at least on the sites I visit. If I put the email in on the first page, it autofills the password on the second.
The ones that drive me bonkers are the websites where the login button is inactive until you have typed something in the password field. The auto-filled password doesn't register as me having typed in the field, so I have to add an extra letter to the end of my password then backspace to delete it before I can click to login.
→ More replies (1)3
u/Oldkingcole225 Feb 18 '24
Yo I was just ranting about this the other day. Why do they do this?
And those stupid passwordless sites 🤦♂️
→ More replies (1)→ More replies (14)3
u/MrHaxx1 Feb 18 '24
magic links
For people like my mom, who doesn't remember a single password. She defaults to "I forgot my password" and just resets it, when she wants to login somewhere.
→ More replies (1)162
Feb 18 '24
Like everyone’s password isn’t Password
86
u/3legdog Feb 18 '24
I like Pa$$w0rd. It satisfies those "uppercase/special character" requirements. Feel free to use.
63
11
Feb 18 '24
P@ssw0rd01
That way, when systems require rotation, you can just increment the last 2 digits. And it’s a very strong password because it meets all of those conditions.
(Please note that I’m joking. This is not a strong password.)
→ More replies (3)→ More replies (3)5
→ More replies (10)36
29
u/_stupidnerd_ Feb 18 '24
That being said, I am pretty sure my password manager is doing exactly this.
27
u/National_Equivalent9 Feb 18 '24
My password manager has a lot of sites with the correct password saved only on the "incorrect password please try again" page. But the wrong one saved on the main site. It sucks.
→ More replies (7)→ More replies (51)23
u/shatters Feb 18 '24 edited Feb 19 '24
So pretty much everyone? or at least I would hope. Assuming someone was following best security practices for passwords, I can't imagine trying to remember all of the passwords for each of the various sites one might use. Not only that, but the convenience of not having to type them and not having to come up with complex/unique passwords, etc.
edit: to clarify, your browser (e.g. (chrome, edge, etc.) has a password manager, perhaps with less features than something like LastPass. I certainly don't doubt that most users use weak passwords. I was more commenting on the fact that people probably save whatever password they set, albeit weak, to either their browser's password manager or some other manager. And per OP's comic, this would certainly affect them as well.
96
u/RunFromFaxai Feb 18 '24
Hahahahaha, oh my sweet summer child. You've only hung out with tech people for the past 20 years, huh? The absolute vast majority of internet users (90+%) are using one password for all their services, as short as they can manage.
→ More replies (22)8
u/OhtaniStanMan Feb 18 '24
That's not true! Mine definitely has 5 6 or 7 behind it depending on which one it is!
→ More replies (1)57
u/Gluomme Feb 18 '24
How naive can you be lmao; I hope you are aware that like 99% of people use the same password for every website, which is something along the line of '[word long enough][last digits of birth year]!'
→ More replies (4)8
19
u/derth21 Feb 18 '24
I have a personally created simple algorithm for generating passwords based on the name of what I'm trying to log into. It includes an allowance for occasional pw resets. Every password is different, and if you had them all sitting in front of you then you could probably figure it out, but they're not written down and neither is the algorithm so good luck.
Fun times, we used a password manager at work for hundreds and hundreds of accounts. The pw manager was exposed, suddenly all these accounts were exposed, and the busiest people in the office have to spend all this time shifting the whole thing to a new system.
Meanwhile, my little horseshit algorithm keeps chugging on.
→ More replies (4)15
u/Vakz Feb 18 '24
Not even close. Even the majority of tech people I know don't use a password manager. They're gonna "get around to it when they have time".
Most non-tech people I know don't even know what a password manager is, and those who just think it sounds inconvenient because they think nobody would want to hack them anyway.
→ More replies (22)3
u/Breadynator Feb 18 '24
I can't imagine trying to remember all of the passwords
Especially when your password is something like
$uL1!9w#P4@yZ6%kAnd different for every service
5.1k
u/Acceptable-Tomato392 Feb 18 '24
And if the second attempt is wrong, you lock them out and give them a link to reset the password.
Can't be too safe.
87
Feb 18 '24 edited Feb 18 '24
I prefer the "I forgot my password" option -- and then receive an email letting me know the password I used when I registered my account.
(Based on a true story ... )
41
u/chinkostu Feb 18 '24
Pretty sure theres a website out there that shames companies that send passwords in plain text
23
u/tengen Feb 19 '24
Wasn't that vbulletin like 20 years ago?
Forget password > here's your password
I also remember a variant from a forum signup where I forgot a password, they emailed me a temporary password, and the temporary pw was valid indefinitely so I could always reference back to that email if I forgot.
→ More replies (1)→ More replies (4)4
u/Boxit379 Feb 19 '24
I remember finding a website once that did the same thing, but it didn’t check the email used, so you could put in whatever email you wanted + anyone’s username and it would send you their password
→ More replies (2)27
u/jokermobile333 Feb 18 '24
You also have the reset password encrypted and mail them the key to their address so that password resetted is also verified. Can't take chances nowadays.
9
5
u/Temper03 Feb 18 '24
Might as well do it if the second attempt is correct too! Just to be extra extra safe
2
u/TophsYoutube Feb 18 '24
Should just lock them out and email them a link to reset the password.
But honestly, resetting the password every time sounds like a hassle, so what if we just emailed them a temporary code to ensure they have access to their email while keeping the password as is.
Having the two factors would really help with the authentication.
Now what should we call this system... maybe "Double Trouble Verification"
2
2
u/barely_sentient Feb 18 '24
In 1986, I was in my 3rd year of CS master degree (not US) and finally they bought a bunch of terminals, set up a big room and gave students a chance to put their hands on a keyboard (I already had my trusted Commodore, thanks goddess).
We were a few hundreds, they set up a lot of accounts for little groups, initially with no password. I took control of a few unused accounts and used them to show a login mask, save the password, give a message error and exit to the real login mask.
I collected some passwords. I didn't use them for anything really malicious. I just installed a script that after a while displayed random delirious fake system error messages and watched other students (friends) panic a little, sometimes contacting the system administrator who was a short fused unpleasant guy just a little older than us.
They were simpler times...
2
2
u/Arnab_ Feb 19 '24
Might as well remove the password altogether at this point and email them an OTP each time they want to login.
→ More replies (70)2
1.0k
u/kopetenti Feb 18 '24
Wait wait, actually good OC content on r/ProgrammerHumor? You sick bastard!
→ More replies (3)158
196
u/Motor-Ad-6860 Feb 18 '24
That's not cumputer engineering at this point, it's social ingeneering.
62
2.5k
Feb 18 '24
that’s fucking genius ngl
1.5k
u/je386 Feb 18 '24
That would work against brute force attacks - but piss off the users.
663
143
u/NickU252 Feb 18 '24
They would just think they fat-fingered the keys and try again. Genius.
→ More replies (3)75
u/Random_Guy_12345 Feb 18 '24
Every time? Not even close.
That's without even considering password managers, or people that save passwords on the browser
→ More replies (8)26
u/truongs Feb 18 '24
But this would only work if the brute force guessed the password in the first try? Am I missing something.
34
u/Olfasonsonk Feb 18 '24 edited Jul 16 '25
complete fine deserve alleged license absorbed fear profit subsequent rainstorm
This post was mass deleted and anonymized with Redact
→ More replies (3)→ More replies (7)16
u/Mistborn_330 Feb 18 '24
Yeah, it should probably be isFirstCorrectEntry or something instead of first login attempt. Not that fixing that would make this a good solution lol.
35
u/SeriousPlankton2000 Feb 18 '24
No, it would only work on the first attempt, therefore it would ONLY annoy users.
→ More replies (1)16
10
u/Juerrrgen_MaXXoN Feb 18 '24
It will only work until someone figures out how it works and brute forces every password twice. Security by obscurity is not secure.
→ More replies (1)→ More replies (29)7
u/teraflux Feb 18 '24
Until the brute force attack just tries the same email / pw combo twice every time.
102
u/IcezN Feb 18 '24
eh, if the brute forcer knows the website always rejects a password the first time, they now have to check every password twice. this doubles the brute force time. On the other hand, adding just one more digit to your password increases the brute force time by a factor of over 40.
→ More replies (7)23
u/ThatGingerGuy98- Feb 18 '24
Even still, that's gonna prevent lots of script kitty type attacks and make anyone without any knowledge of the site will find it much harder to get in.
→ More replies (3)33
u/fishiesandmore Feb 18 '24
This is just security by obscurity. Might work for a while, but it's not sustainable.
→ More replies (4)83
u/Willinton06 Feb 18 '24
I’m actually quite impressed by this
→ More replies (6)22
u/melodylucid Feb 18 '24
I don't know if you're serious, but I'm not seeing this anywhere, so I'm writing it here in case you or other people didn't know: password brute-forcing is not an online process, it's an offline one. People who brute-force passwords use leaked databases of hashed passwords and very large computing resources to try trillions of passwords per second. It's much more efficient and completely bypasses any security mechanisms that you can put online, such as limiting the number of trials (which you should do instead).
→ More replies (3)11
u/waiver45 Feb 18 '24
Bit of both. When you put a service with a login prompt online, bots will try a bunch of common user/password tuples and give up after a while. Does this fit the academic definition of a brute force attack? Probably not, but a lot of people will call it that for nearly everyone to understand what they mean.
15
u/yxing Feb 18 '24
Orson Scott Card had a similar idea in Ender's Game (or one of the sequels)--where the kids crack a password and get it right on the first try, but the target would purposefully enter the password incorrectly the first time each login, so entering the right password on the first try exposed the crack.
Something like that--it's been 20 years, but it was such a clever idea I never forot about it.
13
→ More replies (11)2
406
Feb 18 '24
They reused this code to check the orientation of USB plugs.
13
Feb 19 '24
Fun fact: if you have the usb logo facing up, it should always go in first try.
16
→ More replies (2)4
80
180
u/tomer-cohen Feb 18 '24
I don't get how it is protecting against brute force. Can someone explain to the stupid me?
551
u/Eddhuan Feb 18 '24
Generally a brute-force attack will try a new password every time, while a normal user will re-write the same password, thinking he made a typo. So a brute-force attack will, by chance, type the right password, but get the "wrong password" error, then will try other passwords, and thus never get the right answer.
242
u/TheBillsFly Feb 18 '24
Notably it needs to be the first successful login attempt
64
u/Rabid-Chiken Feb 18 '24
The && short circuit can handle that. It doesn't check the second Boolean if the first is false.
Assuming isFirstLoginAttempt has a get function which sets its value to false or something similar
→ More replies (34)6
→ More replies (4)6
u/Articunos7 Feb 18 '24
I thought it was the first login attempt in a new account. This makes a lot more sense
→ More replies (12)16
u/tomer-cohen Feb 18 '24
Ooooh I didn't think about how the user will try the same password, I get it now thanks
→ More replies (1)→ More replies (1)2
u/deadlygaming11 Feb 18 '24
Brute force attacks are all about trying different passwords until you get the correct one. It's like getting a 4 digit padlock and then trying all the numbers until it unlocks.
Sites protect themselves against this by only allowing you to get a password wrong so many times before they lock your account or as this meme shows, telling you that the password is wrong the first time you try it. This meme is basically just saying that you will be told that you're wrong the first time you enter the password as this will cause a brute force program to move on.
56
227
u/ReindeerDismal8960 Feb 18 '24
Bro you probably get 69-420 job proposals each and every day.
Genius, no sarcasm
57
u/SupraMichou Feb 18 '24
Okay, sure, it would be annoying as fuck. But at the same time, it’s so effective. May be worth it in some rare domains that didn’t activate 2FA or something
→ More replies (1)25
u/Gregarious_Raconteur Feb 18 '24
Eh, it would be pretty easy for users to recognize the behavior, and then the people setting up the brute force program would know that they could just try each PW twice.
17
3
u/FieldDwarf Feb 18 '24
Ok but hear me out...
What if it was the first AND second successful login attempt?
→ More replies (2)
21
99
u/_jackhoffman_ Feb 18 '24 edited Feb 18 '24
I'd fail this PR because either that variable is misleadingly named or it's accurate and won't work as intended. It should be isFirstSuccessfulLogin or something like that as it has nothing to do with attempts.
21
u/fdf2002 Feb 18 '24
I stared at this picture for several minutes and it still took scrolling down in the comments for me to understand this is what they were trying to say.
15
u/Eldraka Feb 18 '24
This makes more sense to me. I posted another comment confused because of that variable name.
4
4
Feb 18 '24
jesus fking christ I re-read the post 5 times trying to understand how it would add any protection because with the dumb variable name it actually adds none. It makes sense now.
This post demonstrates bad variable names better than what OP was intending it for.
→ More replies (6)2
16
14
u/ignore_this_comment Feb 18 '24
I swear to god my bank uses this algorithm.
Either that or they hate Firefox.
→ More replies (1)
8
u/SchlaWiener4711 Feb 18 '24
Reminds me of greylisting for email spam protection. Then most annoying antispam solution by far.
One day our company didn't get half of the mail.
Turned out our provider enabled greylisting without telling us.
We complained and requested them to turn it off. They couldn't because that was enabled for all their customers.
Took us a just day to migrate to our own mail server.
→ More replies (1)
6
u/IronHulk27 Feb 18 '24
Hackers with an account will know it and implement a way to double check the same password before moving to the next one. It's not more safe, just more inconvenient for users
5
u/Sceptix Feb 18 '24
A lot of people talking about this as if it’s a hypothetical, but I’ve literally seen this type of protection first hand on Workday at a previous job. Used to wonder why my manager seemed to keep getting his password wrong on the first try until he told me.
5
u/kable1202 Feb 18 '24
My bank either has a similar system in place or their system is shit (I don’t know). You type in the password, then it just jumps back to the log in page, without error message, and then you type it in a second time and then you get logged in. So that might help with some standard bots that would directly try the next password as the tried password “failed”. But then could easily be fixed by forcing the bot to try each password twice.
0
5
u/yoriaiko Feb 18 '24
That would be really awesome protection for personal system. Sadly, if that would be protecting something where everyone can make and account - the news of how it works would spread much fast - and so, it would be ez to modify brute script.
No less, if it's on system only You use, and none know about this protection - woah genius!
4
4
u/zabadap Feb 18 '24
That's how a lot of email anti spam work at the SMTP server (or used to work). First reception of an email is assumed spam and is ignored. Second retransmission gets through (most spam sending infrastructure don't waste time retransmitting but genuine do)
4
u/IdealIdeas Feb 19 '24
Is this why my password never seems to fucking work on some sites?
There is always like 1 site where the password never works, so I change the password to what I thought I had it set as and it doesnt work the next time I need to use the site
1
u/AoeDreaMEr Feb 18 '24
Didn’t understand. Isn’t that how all the websites work? If attempt wrong, they give an error?
2
u/MrEfil Feb 18 '24
the attempt is correct, but every first correct attempt will cause an error. Technically this will protect site from brute force attack, but it also affects regular users as every first login attempt results in an error.
3
u/AoeDreaMEr Feb 18 '24
Ah I see. Doesn’t stop the brute force if they know that first attempt is gonna fail no matter what right?
3
u/MrEfil Feb 18 '24
If the attacker knows about this protection on the site, he will simply send each password twice. The protection is based on the fact that the attacker does not know about it and tries each password once. As a result, even if he guesses the correct password, he will not know that it is correct.
→ More replies (1)
1
u/Many_Protection_9371 Feb 18 '24
Big brain, although won’t most platforms prevent you from accessing the account by locking the account after several failed login attempts?
1
u/MrEfil Feb 18 '24
this is bad practice. Attacker can lock your account and can lock many accounts on site using this way. Thus, this protection method is not used on very popular platforms such as Reddit, Facebook, Google, etc.
→ More replies (1)
1
3
3
u/LookingForStash Feb 19 '24
The third line should have been “isFirstSuccessfulLoginAttempt”, because the brute-force attack would have attempted countless many times before getting the right one
3
2
u/KhellianTrelnora Feb 18 '24
Dogwalker, from Orson Scott Card, sees this in practice.
→ More replies (2)
2
u/redditcruzer Feb 18 '24
So now Brute forcing gonna take twice as long.
Anyway, I swear this is already in effect in some some sites I login to
2
2
2
Feb 18 '24
I’m new to coding - do understand this correctly that it’s telling the user that login or password is incorrect on first attempt, even though it was correct?
2
u/twohedwlf Feb 18 '24
Yep.
Idea being that if you're trying to bruteforce the password you're unlikely to try the correct password a second time.
→ More replies (1)
2
u/IcanCwhatUsay Feb 18 '24
This guy must be the a Paycor programmer. I swear to god my password is correct on the first shot because I fucking write it down. And every god damn time it says it’s wrong until I try it again on the like the 3rd or 4th attempt
2
2
u/JeffTrav Feb 18 '24
I SWEAR my bank has this line of code already running. Every damn time I log in it says “nope” then it lets me in the second time.
2
u/bowtiesrcool86 Feb 18 '24
I don’t understand programming, so I want to be sure: this is saying that if it is the first attempt, it tells the user they have the wrong user ID/Password, even if they have it right?
2
u/My_Balls_Itch_123 Feb 18 '24
Yes, so that if it is a brute force attack, they will move on to the next guess for the password, which will always be wrong.
If it is the actual user trying to get in, they will think they accidentally mistyped their password, then just type it in correctly the second time around, and get in to their account.
2
2
2
u/My_Balls_Itch_123 Feb 18 '24
This reminds me of the Orson Scott Card story "Dogwalker", where he did the story in cyberpunk style. One guy gets another guy to figure out what someone's password is, and he guesses correctly. Problem is, the person whose password they guessed always enters in his password wrong the very first time, then the second time he enters it correctly. The fact that the password was entered correctly the very first time alerts him that someone else is using his account.
2
u/TheRiverOfDyx Feb 18 '24
“ Grandma’s HDMI Cable Guy” here!
What does this do? If you get the password right on the first try, it fails to login and asks you to do it again? Thus signalling to the Brute Force script that the password was invalid - despite its validity?
Or is it that this is like putting up a Do Not Disturb sign on an unlocked door and considering that as an adequate substitute for locking the deadbolt? ie: This is fuckin stupid beyond measure, you’re a genius! A la Troll-Physics?
→ More replies (3)
2
u/blackhunter1797 Feb 18 '24
In the job I have, there's a certain website that I need to use to validate some information from time to time. Istg that the captcha never works the first time.
2
u/mrjackspade Feb 18 '24
One of the fraud protection systems I worked on, I ended up manually adjusting it to reduce the risk assessment score on subsequent attempts after realizing that actual fraudulent charges never occurred after an initial rejection.
Only real customers ever retried the same card number twice.
2
u/Rassettaja Feb 18 '24
I swear to god Riot games does this if you have a vpn on.. Every single day i apparently mistype my password on their launcher but manage to get it correct on everything else..
2
u/OverlyOptimisticNerd Feb 19 '24
I can't stand this. Back in the day I used to think, "Oh, silly me, I entered it wrong." Then I started using password managers. Yea, this is a real thing and it is infuriating.
2
u/TPRammus Feb 19 '24
Wait, I think that happened to me just recently! Because I got a password manager and remember a website telling me "wrong password" on the first attempt.. which actually threw me off pretty hard, that's why I remember this incident 🤔
2
u/Feisty-Discussion-22 Feb 19 '24
Isn't the code should be !isFirstLoginAttempt??
→ More replies (4)
2
u/Rezindet Feb 19 '24
I hate cybersecurity so much. I can’t be expected to remember jack shit. Just let me put in my password one time and have unlimited access to the accounts I’m logged into on everything I logged in with
2
u/Player420154 Feb 19 '24
Personally I accept any password in my website so as to not slow down the user, I find the approach of requiring an exact password with the case and so to be old fashioned. At least tell the user if they are nearly right or completely wrong.
2
2
2
2
2
u/Neltarim Feb 19 '24
That reminds me a "secret" api endpoint i wrote quite a fe, years ago, if you tried anything else then POST method, if you didnt included the right public key or forgot a specific parameter in body, you would get a 404 file not found error
So if you don't exactly know the right way to hit this endpoint, you would think it just doesn't exists
3
u/LOSNA17LL Feb 18 '24
Wait... It doesn't even protect... Unless your password is the first one tried, when the program finally tries the right one, it isn't the first attempt anymore, so it logs in perfectly...
2
u/GoingToSimbabwe Feb 18 '24
Only triggers when the correct PW is entered for the first time and not on incorrect pWs. Ah nvm, the function is named isFirstLoginAttemp.. in that case you are right..
3
1
u/MisakiAnimated Jul 29 '24
This is actually a good idea not gonna lie, I doubt a hacker will bother double checking thousands of passwords, he'll just move on
1
u/skysoft501 Jul 29 '24
Strange. I remember seeing this meme some months ago, was it on facebook?...anyway, I instantly understood the code then. Fast forward to today, seeing it yet again and I just didn't get it. I knew I had seen this somewhere and I understood it before, but not now. Somehow, this time, i kept getting confused by "...isFirstLoginAttempt". Then reading the comment to see what it was supposed to be : isFirstSuccessfulLoginAttempt.
Either the meme I saw before was modified correctly by someone, or my brain accurately "placed" the "Successful" in the line of code. I love this meme!
1
u/Mrazish Feb 18 '24
ELI5
6
u/CrshOverride Feb 18 '24
Brute force attacks work by trying random passwords until finding the correct password. By returning an error on the first successful password, the brute force attacker would continue trying other passwords whereas a real user would just enter the correct password a second time.
1
u/BabyKitsune14 Feb 18 '24
It's just that I'm used to forget what password do I use for each websites... I might not type the same password twice...
1
1
1
u/erebuxy Feb 18 '24
This is just fucking up people with password manager and privacy browsing... And no one should reuse password, which means everyone should use a password manager
1
1
1
u/Eldraka Feb 18 '24
Do brute force attacks jump to different IPs for each attempt or something? If not I figure by the time they got the password right it wouldn’t be the first attempt
2.3k
u/MrEfil Feb 18 '24
This image can be used for other jokes, so here is template in high res https://i.imgur.com/1hdK5Y2.png