Hacker News Reader

Comment by DiogoRolo | Hacker News Reader

Pressing enter will submit the current written password in the prompt. If the user is using that to wake the screen, probably the password field is empty so you're submiting a wrong password which might lock your account for a while if you have several failed attempts already

View on HN

Windows should be smart enough to know an empty password doesn't meet the password complexity requirements or is of length zero and not count it against the 'bad password count'.

> Windows should be smart enough to know an empty password doesn't meet the password complexity requirements or is of length zero and not count it against the 'bad password count'.

All that logic sounds like a recipe for introducing a side channel attack into the system. Much better to keep things simple.

What kind of side channel exists if the behavior is: if password is required, zero length input is always invalid. This seems kind of like basic UX. I mean I wouldn't expect the password field to validate against the password complexity requirements exactly, just that zero length input is probably a mistake.

Windows has managed to maintain an amazing amount of backwards compatibility. Sometimes that means decisions that seem odd at surface level. I would not be surprised if there is some corner case where changing the current behavior means something else breaks.

If anything, I would guess it's some silly outdated but codified ISO standard that propagated far and wide and entered contractual obligations, like passwords needing to be changed every 3 months.

The goal is to delay bad actors, though, and that doesn't really help with that.

how so? The form shouldn't even submit an empty password, and just guessing the same password over and over again is not exactly going to resuilt in success on the 1 millionth attempt.

> The form shouldn't even submit an empty password,

But it does. And if you have someone malicious trying to access the machine that way, why not lock them out on the first attempt?

I can see the advantage in simplifying things by not submitting blank passwords also, although I also think it isn't necessary.

> not exactly going to resuilt in success on the 1 millionth attempt.

Not, but 2 or 3 attempts should lock the account. I don't see an issue in treating a blank password submission as an attempt, but I guess denying that is easier than trying to educate users.

I don't see how it makes any sense as a behaviour other than not having thought to special case it: it's a signal which is blindingly more likely to be an error than an attack, and has no chance of success as an attack. It makes perfect sense as an affordance, even with user education.

I agree, my point was nonsense. I was still waking up.

This example makes no sense to me. An attacker is potentially logging on to the computer and submitting empty passwords to get in. And this is what we're trying to prevent at the expense of having an unclear UX?

I was wrong. Still sleepy.

Reply on news.ycombinator.com