I've had a thought. I don't know if it's good. I don't know if it's bad. That's for you guys to decide.
People are probably familiar with sites like these
https://howsecureismypassword.net/
http://www.passwordmeter.com/
They test the strength of your password.
But if I was to make a site pretending that it could test your, for example, youtube or gmail passwords, I could send it to people.
They input their password to test it, I find out their email or username and boom, hacked.
Would this work? Need opinions please.
Yes, it would work. But let me explain something to you. Most emails range anywhere from 5-20 characters. So that'd be a string combination of about 36^20. So that's 13,367,494,538,843,734,067,838,845,976,576 possible combinations for an e-mail username. And that's excluding the @[EMP].xxx part. And it's not like you're going to trick anyone with why they'd need to input their e-mail just to check how strong their password is. Finally, some people can have 2-5 different passwords they use for various accounts. So again your odds got even slimmer that the password they tested is even for an e-mail.
(Feb 15, 2014 08:54 AM)Apex™ Wrote: Yes, it would work. But let me explain something to you. Most emails range anywhere from 5-20 characters. So that'd be a string combination of about 36^20. So that's 13,367,494,538,843,734,067,838,845,976,576 possible combinations for an e-mail username. And that's excluding the @[EMP].xxx part. And it's not like you're going to trick anyone with why they'd need to input their e-mail just to check how strong their password is. Finally, some people can have 2-5 different passwords they use for various accounts. So again your odds got even slimmer that the password they tested is even for an e-mail.
I didn't mean trying to crack their email or username too. I meant if I knew that one persons email or username I could send them the link. Of course this wouldn't work for getting a massive amount of accounts but it could still be worth it.
If I got a massive mailing list of gmail accounts I could create a fake email from google and send it to all of the addresses, that could get me some pretty decent results. It's just an idea anyway.
I believe these sites record no info. Just make sure not to use the passwords for something important like paypal or other stuff like that.
(Feb 15, 2014 08:40 AM)Saint Wrote: I've had a thought. I don't know if it's good. I don't know if it's bad. That's for you guys to decide.
People are probably familiar with sites like these
https://howsecureismypassword.net/
http://www.passwordmeter.com/
They test the strength of your password.
But if I was to make a site pretending that it could test your, for example, youtube or gmail passwords, I could send it to people.
They input their password to test it, I find out their email or username and boom, hacked.
Would this work? Need opinions please.
You could disguise an email verification to record their emails or SE and say the username length differs on the security of the account aswell.
You'd also need to find a way to blacklist passwords that people put in just to troll themselves such as getting infinity passwords.
If you think that my post was informative, funny, or helpful; maybe donate a couple of bytes? There's a chance you'll win up to 250 bytes for donating!
|
