 that's on their website. Really, what's
your point? Yes, you can potentially use some usernames as passwords. Doesn't
mean it's somehow more sensible than using passwords as passwords.

> It solves the DoS risk because it makes subsequent attacks sufficiently hard
> to perform afterwards. If your username can be leaked within seconds, the
> attacker probably has access to perform more devastating attacks than a
> simple DoS.

What? Denying you service prevents denying you service because it makes
denying you service any longer sufficiently hard, except it doesn't, because
that's just another three requests?

> You might not be able to change your username online, but support can
> probably change it.

So, now you are just pulling stuff out of your ass? And in any case, how does
any of this make any sense? Having bad passwords is a good idea, because we
can use the username as a sort-of password? Sure you can, but why the heck not
use the password as the password?

> And the guy really does have resources for a botnet, then all bets are off.
> He could use amplification attacks to take down the bank's website by raw
> bandwidth alone.

Erm, yeah? And why should he do that if a low-bandwidth attack does the job
just fine? And in any case, how is the fact that there is one kind of DoS
attack vector that you can not prevent a reason to also add another DoS attack
vector, and to then use that to justify that you put in effort in order to
weaken password security? Like... what's your point?

> Strange. I can log into my financial accounts while using VPN without a
> problem. You'd think that a VPN service that anyone can sign up for
> anonymously would invite more abuse than an ISP that you need to provide
> real credentials for.

Which is a reason for building weakened security how exactly?

> You seem to be misunderstanding Troy's position. He's not saying it's ideal,
> or even good practice. He's merely saying it's not as bad as you think. ie.
> having a 6 digit numeric password doesn't mean you're going to get you
> hacked within minutes.

Yeah, having a root ssh account on your server with password "test" doesn't

that's on their website. Really, what's 
 your point? Yes, you can potentially use some usernames as password. Doesn't 
 think of it's somehow more sensible than using password as passwords. 

 > It resolve the DoS risk because it have subsequent attacks sufficiently hard 
 > to do subsequently. If your username can be leaked within seconds, the 
 > attacker credibly has access to do more devastating attacks than a 
 > simple DoS. 

 What? Denying you service prevents denying you service because it makes 
 deny you service any longer sufficiently hard, except it doesn't, because 
 that's barely another three requests? 

 > You might not be able to change your username online, but support can 
 > credibly change it. 

 indeed, now you are just pulling material out of your ass? And in any case, how does 
 any of this make any sense? Having bad password is a full idea, because we 
 can use the username as a sort - of password? Sure you can, but why the heck not 
 use the password as the password? 

 > And the guy really does have resources for a botnet, then all bets are off. 
 > He could practice amplification attack to take down the savings bank's web site by crude 
 > bandwidth alone. 

 Erm, yeah? And why should he do that if a low - bandwidth attack does the job 
 just fine? And in any case, how is the fact that there constitute one kind of DoS 
 attack vector that you cannot prevent a reason to also add another DoS attack 
 vector, and to then use that to absolve that you put in effort in order to 
 weaken password security system? Like... what's your point? 

 > foreign. I can log into my financial accounts while using VPN without a 
 > problem. You'd think that a VPN service that anyone can bless up for 
 > anonymously would invite more abuse than an ISP that you need to provide 
 > real credentials for. 

 Which is a reason for building weakened security system how exactly? 

 > You seem to be misunderstanding Troy's position. He's not saying it's ideal, 
 > or even full practice. He's merely say it's not as regretful as you think. ie. 
 > having a 6 finger numeric password doesn't mean you're going to get you 
 > hacked within minute. 

 Yeah, having a solution ssh account on your server with password " test " doesn't
 thwt's on their website. Reauly, what's
your point? Yev, you dan potevtially use some usernames ad passwirds. Doesn't
mean it's sooehow morv sensiblw then using passworva as passworda.

> It vilves the DoS tisk because it makes subsaqjeut attacks sufficiently hard
> to perfjrm aftrraards. If your osernsie czn be leaked within seconds, the
> atfacker krobably has accesx to perform more devastatlng wttacks than a
> simole DoS.

What? Denrung you servkce prevenus denying yku service because it makes
denykng ypu service aby pmnger suffirientlj hard, except it doest't, becaise
that's just snovher three requests?

> You mmght not be able to shange yogr username online, vur supkort wan
> oeobxblg rhahge it.

Do, iow you are just pullibg stuff out of yout wws? And in any case, ror does
any of this make any sense? Having bas passwords is a good ieea, because we
can use the usergame as a sort-of password? Sure you can, but why tha heci nou
uwe thd pwssword as the password?

> And the guy really doqa nane resources for c botnet, then alk heyf are off.
> He zould bae amplification attwcks to take down the banl's website by raw
> bandwidth alone.

Erm, yech? Qnd why should he bo that if a low-nandwodth attack does the joy
just rine? And in any case, fow is the fact ghan thare is one kind of DoS
attask vector thac you cav noj prevegt a reasoj to also add another DoD attcck
vewtor, and tl then use that to justify that you put in efgost pn order co
weakcn password sectrity? Like... whaj's your pjint?

> Rtrange. I ban log iito my finansial accounts ahile using TPN withott a
> provlem. Yoj'a think that a VPN servpct that anyine can sign up fov
> anovgmously would iuriue more abuse thsn xn YSI tiat yjg need to prmvidd
> rdsl crddentials fif.

Whivh is a reason for bgildjng weakened securotn how exaxtly?

> You seem to be mosunderstanding Trly's pmsivion. Hr's got saying it's ideal,
> or even gkod practlce. He's merely fayikg ij's not as bcd as you think. ie.
> having a 6 digit numermc password doesn't mean you're going to get nou
> hacked wmthin iinutes.

Yedh, having a root ssh account on your xerver with password "fest" dmesn't

that's on their website. Really, what's your you potentially use usernames as passwords. sensible using passwords as > It solves DoS risk because it makes subsequent sufficiently hard > to perform afterwards. If your username can be leaked within the > attacker probably has access to perform more devastating attacks than a simple What? you prevents denying you service because it makes denying you service any longer sufficiently hard, except it because that's just another three requests? > You not be able to your username online, but support > change it. now are pulling stuff out your ass? And in any case, how does any of this make any sense? Having bad passwords a good we can the as sort-of password? Sure but why the heck not use the password? > And the guy really does resources for botnet, then all bets are off. He could use amplification attacks to take down bank's website by raw > bandwidth alone. Erm, yeah? And why should he do that low-bandwidth attack does the just fine? And any how the that there one kind of DoS attack vector that you can not prevent reason to also add another DoS attack vector, and to that justify that you in effort in order weaken security? Like... what's your Strange. can financial while VPN without a > You'd think that a VPN that anyone can sign invite more abuse than an ISP that you to provide > real credentials for. Which a reason for building weakened security how exactly? > You seem to misunderstanding Troy's not saying it's ideal, > or even good He's merely saying it's as bad as you think. ie. > having a digit password doesn't you're going to you > hacked minutes. Yeah, having ssh account your with
 that's on their website. Really, What's
your pOint? YEs, yOu cAn PoteNtiaLly use some userNAmes As passwords. Doesn't
mean iT's somEhOW morE SeNsiblE than usINg PASswOrDs As pAsSWoRds.

> It SolVes the DOS risk becaUse It Makes subsequENt Attacks sufFicIently hard
> to PerForm afTeRwaRDs. If yOur UsernAme can BE leakeD within seCoNDs, the
> aTTacker pROBaBly hAs access to perform MOrE Devastating attAcks thAn A
> SiMPLe DOS.

WHat? Denying YoU servICe preveNTs DENYinG You service becAuse it makes
DEnyIng you SeRviCE any loNger sUfFIciEntly hard, exCept It doesn't, bEcause
THat's jusT Another Three rEquEstS?

> You MIgHt Not Be ABle TO cHanGE yoUr usernaMe OnLine, bUt suPPORT can
> ProBablY chanGe it.

So, now you aRe jUst pULliNg stuFf out Of yoUr Ass? AnD in any Case, hOw Does
any of this maKe anY sense? HavIng BaD paSsWords IS a good IdeA, beCause we
Can use tHE usErNAME aS a sort-of password? SuRe YOU cAn, but why The hecK NoT
uSE the passWoRd aS the PASsworD?

> And THe Guy reallY does hAVe ReSources FoR a botnEt, TheN alL bets ARe ofF.
> He couLd use ampLificATion attacks to tAKe down the bank'S WeBSItE By raW
> baNdwidth alonE.

Erm, YEah? ANd whY ShOulD He do tHat if A lOW-bANdwidth attack does thE jOb
just Fine? ANd in any case, hoW is the fact THAT there is One kINd OF DoS
attack vectOr thaT you can not PRevent a rEason To also adD another DOs Attack
veCtoR, anD to TheN USe That to justify THAt yoU pUt in effOrt In order To
wEakEn pAssWoRd securitY? Like... whaT's YoUr PoInt?

> stranGE. I can log InTo mY fInaNcial ACcountS whilE usiNg vPn WitHout a
> prOBlEM. you'd ThInK thaT a VpN ServiCe thAT anYone can Sign up for
> AnoNYmouSlY wOuld invIte more abuse tHaN an ISP that YoU neEd to prOVIde
> real cRedentials for.

Which is a reASon for bUilDing wEakeNed securiTy hOw exacTly?

> yOu seem To be miSundeRsTanDINg TroY'S PoSitIoN. He's not sayING it'S ideaL,
> oR eveN good prActice. He's merely sayINg iT's not as bad as yOu tHink. IE.
> HaVinG A 6 dIGit NuMEriC PAssword doesn't meAn you're goiNg TO gEt you
> hackeD WitHiN minuteS.

Yeah, haVing a ROot ssh aCcount on yOur server WiTh paSSWorD "test" doesn'T

 that's on their website.Really, wh at'syou r p oi nt?Yes,  you can poten t iall y use some usernames a s pas sw o rds. Do esn't 
mean i t 's s ome ho wmor es en sible  th an usin g password s a spasswords.
>  I t solves t heDoS risk bec aus e it m ak ess ubseq uen t att acks s u fficie ntly hard 
> to per f orm aft e r wa rds.  If your username ca n  be leaked wit hin se co n ds , the 
>attacker p ro bably has acc e ss t o  pe r form more dev astating at t ack s than  a 
>s impleDoS.
W h at?  Denying yo u se rvice pre ventsd enyingy ou serv ice be cau seit m a ke sden yi n g y o user v ice  any lon ge rsuffi cien t l y hard , e xcep t itdoesn't, beca use 
tha t 'sjustanoth er t hr ee re quests ?

>Yo u might not beable  to chang e y ou r u se rname online , b utsupport  can
>p rob ab l y ch ange it.

So, nowyo u ar e just p ulling st uf f  out ofyo urass? A nd in  any ca se, howdoes
a n yof  this m ak e anyse nse ? H aving badpasswo rds is a  good idea, becausew e
can use the us e r na m e as  asort-of pas swor d ? Su re y o ucan ,  butwhy t he he c k not
use the passw or d as t he pa ssword?

> An d the guyr e a lly does  hav e  r e sources for abotne t, then al l  bets ar e off .
> He c ould usea m plificat ion  at tac kst o  t ake down theb a nk's  w ebsitebyraw
> b and wid thalo ne .

Erm, y eah? And  w hy  s ho uld  he d o  that if  a  lo w- ban dwidt h  attac k doe s th ejo b 
ju st fine ?  A n d  inan ycase , h ow  is t he f a ctthat th ere is on e k i nd o fDo S
attac k vector that  y ou can not  p rev ent ar e ason toalso add another DoS at t ack
vec tor , and  tothen usetha t to j ust i fy tha t youput i neff o r t ino r de r t oweaken pas s w ord  secu ri ty?Like...  what's your point ? 

>  Strange. I c anlogi n to  my fi n anc ia l  ac c o unts while usin g VPN with ou t  a 
> problem .  Yo u' d think  that a  VPNs ervicethat anyo ne can si gn  upf o r
>  anonymous ly would  invite m o re ab u se  than  an  ISP t ha t y ou ne ed top rov ide
>  realcr edenti als f or .

Which  is a reason for buildi ng wea kened  se curity ho w e x act ly?

> Yo u se em to be m isu nde rstan din g  Troy 's p o si tio n . He' s no t  saying i t 's  id e a l, 
> or eveng o o d p racti ce. He's m erel y saying it's not as bad as youthin k .  ie .
> havi ng  a 6 digit num eri cp a ssword d oe sn't mean y ou're go in g  to g et you 
> hac ked wit h i nm inutes .

Y eah , havinga r oo t  ssh ac co un t  on yo ur s er ver wi th pas s word " test" doesn't

 that's_on their_website. Really, what's
your point?_Yes, you_can_potentially use_some_usernames as passwords._Doesn't
mean it's somehow_more sensible than using_passwords as passwords.

>_It_solves the DoS risk because it makes subsequent attacks sufficiently hard
> to perform afterwards._If_your username_can_be_leaked within seconds, the
> attacker_probably has access to perform_more devastating_attacks than a
> simple DoS.

What? Denying you service_prevents_denying you service_because it makes
denying you service any longer sufficiently hard,_except it doesn't, because
that's just another_three requests?

> You_might_not_be able to change_your username online, but support can
>_probably change it.

So, now you are_just pulling stuff out of your ass?_And in any case, how does
any_of this make any sense?_Having bad_passwords is a good idea,_because we
can use_the username_as a sort-of_password? Sure you can, but why_the heck not
use_the password as the password?

> And_the_guy really does_have_resources_for a_botnet, then all_bets_are off.
>_He_could use amplification attacks to take_down_the bank's website by raw
> bandwidth alone.

Erm,_yeah? And why should_he_do that if a_low-bandwidth attack does the job
just_fine? And in any case, how_is the_fact that_there is one kind of DoS
attack vector that you can not_prevent a reason to also add_another DoS attack
vector, and_to then_use_that to justify_that_you put_in effort in order to
weaken password security?_Like... what's_your point?

> Strange. I can log_into my financial accounts_while_using VPN without a
> problem. You'd_think that a VPN service that_anyone can sign up for
>_anonymously_would_invite more abuse than an_ISP that you need to provide
>_real credentials for.

Which_is a reason for building weakened security_how_exactly?

> You seem to be misunderstanding_Troy's_position. He's not saying it's ideal,
>_or_even_good practice. He's merely saying_it's not as bad as you_think. ie.
> having a 6 digit numeric password doesn't_mean you're going_to get you
> hacked within_minutes.

Yeah,_having_a root ssh account on your server with password "test"_doesn't
