📜 ⬆️ ⬇️

Cancel user passwords

qwerty of buttons
Alas, my faith in humanity was too naive. When we planned the cloud interface, it was assumed that the person does not really understand the nuances when creating a virtual machine, leaves the default settings (in particular, the automatically generated password), and the person who changes the settings understands what he is doing. Alas, for some customers this was not the case.

We had to turn off the ability to set a user password during installation. Those who want to set their own passwords will be able to do this after the first login with the passwd command. The rest will remain with the passwords of our authorship.

Cause? Well, I guess you guess. Password 323345 - it's just some kind of mockery. And there were several such cases.
')
People who believe that evil hackers will not reach them, because “yes, who needs me there” are absolutely right. No one will specifically sit and pick up your tricky rearrangement from qwerty and 123. For this purpose, specialized programs have been created for a long time, which, believe me in the deepest way, do not care what sophisticated thought you were guided by, making a password of five units and one deuce, placing the two on third position (do not guess the same!). Do not guess. Just demolish brute force with the -th attempt. And they do not need your personal secrets - but your resources. To send spam, brute force the password to the necessary sites, to work as an open proxy. For what a broken car with a good Internet will always be useful ...

One could make a lot of crutches: check the repetition of characters, limit the minimum length, check the password using a dictionary, require characters from different sets (letters, numbers, punctuation marks), you can even set john up before accepting a password. But - this is all half measures. A person who wants his password to be “very simple” will bypass them all.

I really didn’t want to do this, as automatic passwords get in the way of some people. But - alas, we cannot leave alone with the Internet of the machine without a normal password.

From now on, passwords will only be automatically generated.

Source: https://habr.com/ru/post/112794/


All Articles