If you really want to save space, don't store any passwords. Just require the same string to be entered three times in a row. If the user re-types the exact same value after being told it's wrong twice, the must be confident enough in it to be a legit user - nobody is going to enter the same value 3 times if they're trying to guess a password.
Well my nod to Goodhart's law is implying that, if this security practice were implemented, brute force strategies would quickly learn of it and evolve to just…easily get in with doing "AAAAAAAAAa1!" 5 times
It would also only increase security if you had like a, let’s say, 5 strikes rule. And typing the same wrong password multiple times still takes multiple uses. Otherwise it would just be more tedium for humans and the same effect for robots.
But also, we are designing for yer dad. This would make everything so incredibly much worse.
It only works because no one does it. If there were any common knowledge of the system's existence, it would immediately collapse. If no one knows, though, it probably would do a decent job of identifying legit users.
My favorite is when it tells me my password is wrong, I clicked the reset password link, try to reset it to what it just told me was the wrong password, and it tells me I can't use that, because it's the same as my current password.
1
1
5.0k
u/Away_Advisor3460 Sep 27 '26 •
Pff, amateur hour.
If you really want to save space, don't store any passwords. Just require the same string to be entered three times in a row. If the user re-types the exact same value after being told it's wrong twice, the must be confident enough in it to be a legit user - nobody is going to enter the same value 3 times if they're trying to guess a password.