• Larry (unregistered)

    TRWTF is "secret" questions that are MUCH more insecure than passwords.

    Cool! I noticed that if I type my password, TDWTF masks it. Watch: ***********

  • saluto (unregistered)

    nullest

    Saluto, something about greeting or something...

  • some guy (unregistered)

    @Larry Nice try :)

  • The Nerve (unregistered)

    Ok, this is just stupid.

    The Article:
    Hear a Blog -- We are currently narrating this post. Subscribe to get notified when ready.
  • English Man (unregistered) in reply to some guy
    some guy:
    @Larry Nice try :)
    That doesn't work here, you twit!
  • SR (unregistered)

    Why didn't Rob just add his second name?

  • Fred (unregistered)

    TRWTF is the lack of buttons to Logon Out and Logon On.

  • COHERENCE_NOT_FOUND (unregistered) in reply to Larry
    Larry:
    TRWTF is "secret" questions that are MUCH more insecure than passwords.

    Cool! I noticed that if I type my password, TDWTF masks it. Watch: ***********

    let me try...

    hunter2

    cool!

  • Bo (unregistered)

    All my life I've been wondering why nobody would be my friend. Thank you for explaining it.

  • Sam (unregistered)

    Re: Secret password

    Not really a WTF. Obviously a three or four letter answer to a secret question is much more dangerous than a bad password. Since an attacker could simply choose to go the "Forgot password" route.

    If your childhood best friend is "neil" - then just include his last name. Makes much more sense anyways. I.e., neil smith (or Neil Smith) would work just fine.

    If Live allowed answers like neil, tom, ray, or jane - that would be TRWTF.

  • Hunter (unregistered) in reply to COHERENCE_NOT_FOUND
    COHERENCE_NOT_FOUND:
    Larry:
    TRWTF is "secret" questions that are MUCH more insecure than passwords.

    Cool! I noticed that if I type my password, TDWTF masks it. Watch: ***********

    let me try...

    hunter2

    cool!

    Dude, I can see your password!

    Oddly enough, I use the same password myself. What are the odds?

  • (cs)

    The last one isn't a WTF, unlimited storage provides enough storage for all of those things.

  • edthered (unregistered)

    Maybe it's just 'cause I've been in Texas most of my life, but "Logon In" and "Logon Off" just sounds natural to me.

    "Well y'all just logon in then if you wanna get some work done!"

  • Bill (unregistered)

    4,000 music tracks should be enough for anyone.

    And WhyTF is a document two-and-a-half times the size of a music track???!! Must be using Word 2012...

  • Anonymous (unregistered)

    Virgin's bizarre definition of the word "unlimited" is exactly why I left their broadband service. According to them, "unlimited" actually means "unlimited for 16 minutes, after which we limit the shit out of you". This is no exaggeration, on their 10Mb connection you could literally hit the limit after just 16 minutes of usage. They advertised this package as "unlimited". They are utterly full of crap and they have no compunctions about outright lying in their promotional material.

  • (cs)

    Ikea does deliver minimalism to the masses.

  • Bob (unregistered) in reply to Larry
    Larry:
    TRWTF is "secret" questions that are MUCH more insecure than passwords.

    Cool! I noticed that if I type my password, TDWTF masks it. Watch: ***********

    Website:
    Please enter a password. Password must contain at least 2 numbers and 2 letters and be at least 8 characters long.
    A884cardimom
    Website:
    For your security, please enter the answer to the secret question:

    What is your favorite food?

    pizza
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?

    Website:
    Here is your bank account information!
  • Bert Glanstron (unregistered) in reply to frits
    frits:
    Ikea does deliver minimalism to the masses.
    You are an idiot and should be banned from your mommy and daddy’s modem.
  • ed (unregistered)

    Not to beat a dead horse, but guys, watch me beat this dead horse.

  • Chewbacca (unregistered)

    Hmm...

    The "Logon in" and "Logon off" might have made sense if it was "Logon on" and "Logon off". I would have guessed the buttons were for enabling and disabling the logon function.

    Also, let me choin the "That's not a WTF at all" crowd on the Live ID thing. Allowing really short "secrets" is almost as stupid as a multiple choice "secret".

    BTW, am I the only one to notice that the IKEA one actually has a wooden table in it? I'm sure if we zoom in on that stack of magazines we'll be able to read TRWTF from that....

  • Anonymous (unregistered) in reply to Bob
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?
    Website:
    Here is your bank account information!
    I see what you're getting at but you seem to be forgetting one thing - this will only work on the average high-school student, who will have no money in his account anyway. Ask a rich guy what his favourite food is and it sure as hell won't be pizza. It would take a hacker quite some time to stumble on "Pig's Head Terrine with Celeriac Purée".
  • BentFranklin (unregistered)

    Come on down and log on in at www.thepriceisright.com!

  • Larry (unregistered) in reply to Anonymous
    Anonymous:
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?
    Website:
    Here is your bank account information!
    I see what you're getting at but you seem to be forgetting one thing - this will only work on the average high-school student, who will have no money in his account anyway. Ask a rich guy what his favorite food is and it sure as hell won't be pizza. It would take a hacker quite some time to stumble on "Pig's Head Terrine with Celeriac Purée".
    FTFY
  • Some Wonk (unregistered)

    You fools! It's simply teaching you karate.

    logon on left hand.

    logon off right hand.

    And breathe. Always breathe

  • Jellineck (unregistered)

    Great. Burt Glanstron followed by a stupid Hear a Blog comment.

  • The Configurator (unregistered)

    The real WTF is that I sent that V-Stuff image, and my name isn't Glenn Jones.

  • JJ (unregistered)

    diabeetis

  • za (unregistered)

    Neverwinter Nights supports pretty much any resolution - I'm sure it's suggesting that resolution and would run just fine using it, if you got the hardware.

    Problem is, it's interface elements won't scale.

  • Chewbacca (unregistered) in reply to za

    Pfff, you could just have a friend run over to the other end of the wall to check your health.

  • (cs) in reply to Bert Glanstron
    Bert Glanstron:
    frits:
    Ikea does deliver minimalism to the masses.
    You are an idiot and should be banned from your mommy and daddy’s modem.

    Thanks for paying attention to me (my parents never loved me). In return, I will now give you some attention. You're so cool.

  • Jack (unregistered)

    I have guessed your user ID. Pray I don't guess your secret answer too.

  • (cs) in reply to Chewbacca
    Chewbacca:
    Also, let me choin the "That's not a WTF at all" crowd on the Live ID thing. Allowing really short "secrets" is almost as stupid as a multiple choice "secret".
    Actually, allowing any secret question at all is stupid, no point in pretending that it's secure.

    People are getting better at passwords, most people now choose passwords that are combinations of things they remember and have a reasonable amount of entropy. Answers to secret questions are almost always vulnerable to background research and social engineering attacks. The length doesn't really matter, because there is usually exactly one correct answer. The only rational response to a website that asks for an answer to a secret question is to put another password in there and archive it in your password management program.

    What if some popular web site started asking for a bunch of secret questuion answers? You might think that having more for the site to randomly choose from would add to security. However, if the site designer simply asked you for answers to questions from popular banking sites, he'd pretty quickly build a database of a lot of people's answers to secret questions. Wait a few months and you have a database worth millions on the black market.

  • The Queen of England (unregistered) in reply to Larry
    Larry:
    Anonymous:
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?
    Website:
    Here is your bank account information!
    I see what you're getting at but you seem to be forgetting one thing - this will only work on the average high-school student, who will have no money in his account anyway. Ask a rich guy what his favorite food is and it sure as hell won't be pizza. It would take a hacker quite some time to stumble on "Pig's Head Terrine with Celeriac Purée".
    FTFY
    WTF are you people doing to my language?
  • Mad Adder (unregistered) in reply to Anonymous
    Anonymous:
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?
    Website:
    Here is your bank account information!
    I see what you're getting at but you seem to be forgetting one thing - this will only work on the average high-school student, who will have no money in his account anyway. Ask a rich guy what his favourite food is and it sure as hell won't be pizza. It would take a hacker quite some time to stumble on "Pig's Head Terrine with Celeriac Purée".

    Jeez, thanks a lot for giving away my secret answer. I mean, do you know how long it took to acquire a taste for Pig's Head Terrine with Celeriac Purée so I could say it's my favorite food? Now I have to start gorging myself on Scalloped Ocelot Testicles with a Beluga Caviar Garnish.

  • (cs) in reply to The Queen of England
    The Queen of England:
    Larry:
    Anonymous:
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?
    Website:
    Here is your bank account information!
    I see what you're getting at but you seem to be forgetting one thing - this will only work on the average high-school student, who will have no money in his account anyway. Ask a rich guy what his favorite food is and it sure as hell won't be pizza. It would take a hacker quite some time to stumble on "Pig's Head Terrine with Celeriac Purée".
    FTFY
    WTF are you people doing to my language?

    What, German?

  • Mister Zimbu (unregistered)

    The website my apartment uses to do all the maintenance requests and online billing has only two choices for the "Secret Question".

    • What color is your car?

    You mean that thing that's right outside my apartment? No one could possibly guess that!

    • What state were you born in?

    Neglecting to mention the limited domain of possible answers for this question, not to mention that it's not even applicable if you're not born in the US. A security question for a website whose members will all be part of a local community? Seriously?

  • The Queen of England (unregistered) in reply to frits
    frits:
    The Queen of England:
    Larry:
    Anonymous:
    Hacker:
    clicks Forgot my password
    Website:
    What is your favorite food?
    Hacker:
    pizza?
    Website:
    Here is your bank account information!
    I see what you're getting at but you seem to be forgetting one thing - this will only work on the average high-school student, who will have no money in his account anyway. Ask a rich guy what his favorite food is and it sure as hell won't be pizza. It would take a hacker quite some time to stumble on "Pig's Head Terrine with Celeriac Purée".
    FTFY
    WTF are you people doing to my language?
    What, German?
    *Cough* *shuffles papers* ahem...
  • anon (unregistered)

    Why does everyone on this site constantly perpetuate the myth that security questions are inherently insecure? A poor security question system certainly can be insecure, but the vast majority of sites do not let you log in simply by answering the security question. Most sites, and particularly banking sites, will simply email you a password reset link, so unless your email account has also been compromised, it's a non issue.

  • (cs) in reply to Mister Zimbu
    Mister Zimbu:
    - What state were you born in?
    Solid?
  • The Nerve (unregistered) in reply to Jaime
    Jaime:
    Chewbacca:
    Also, let me choin the "That's not a WTF at all" crowd on the Live ID thing. Allowing really short "secrets" is almost as stupid as a multiple choice "secret".
    Actually, allowing any secret question at all is stupid, no point in pretending that it's secure.

    People are getting better at passwords, most people now choose passwords that are combinations of things they remember and have a reasonable amount of entropy. Answers to secret questions are almost always vulnerable to background research and social engineering attacks. The length doesn't really matter, because there is usually exactly one correct answer. The only rational response to a website that asks for an answer to a secret question is to put another password in there and archive it in your password management program.

    What if some popular web site started asking for a bunch of secret questuion answers? You might think that having more for the site to randomly choose from would add to security. However, if the site designer simply asked you for answers to questions from popular banking sites, he'd pretty quickly build a database of a lot of people's answers to secret questions. Wait a few months and you have a database worth millions on the black market.

    Now, my bank actually asks the "secret" questions in addition to the password after I actually log in. When it comes to sites that don't use the secret words in this manner, I try to enter something that is just as secure as the password, and have the same answer to all the questions. I always wonder (and suspect that I know the answer) if they subject the "secret" answer to the same hash as they do the password. But then the other day, I got sent the password to a website I subscribed to in regular text. Great.

    I still talk to programmers who don't understand the reason we use a password hash. Anyone reading this that is confused, please look into it immediately.

  • (cs)

    My childhood best friend in such a situation is usually something like I58an3fwX

  • Bert Glanstron (unregistered) in reply to anon
    anon:
    Why does everyone on this site constantly perpetuate the myth that security questions are inherently insecure? A poor security question system certainly can be insecure, but the vast majority of sites do not let you log in simply by answering the security question. Most sites, and particularly banking sites, will simply email you a password reset link, so unless your email account has also been compromised, it's a non issue.

    Dear anon,

    In case you can’t tell, this is a grown-up place. The fact that you insist on flimsy website security clearly shows that you’re too young and too stupid to be using computers.

    Go away and grow up.

    Sincerely, Bert Glanstron

  • Troll Army 3 (unregistered)

    Those are some large documents.

  • (cs) in reply to Cbuttius
    Cbuttius:
    My childhood best friend in such a situation is usually something like *********
    What?
    This was FTW:
    Not to beat a dead horse, but guys, watch me beat this dead horse.
  • logical.. (unregistered) in reply to Mister Zimbu
    Mister Zimbu:
    The website my apartment uses to do all the maintenance requests and online billing has only two choices for the "Secret Question".
    • What color is your car?

    You mean that thing that's right outside my apartment? No one could possibly guess that!

    • What state were you born in?

    Neglecting to mention the limited domain of possible answers for this question, not to mention that it's not even applicable if you're not born in the US. A security question for a website whose members will all be part of a local community? Seriously?

    oh no! now some dastardly hacker can break into the account and pay for your building maintenance!

  • airdrik (unregistered) in reply to Mister Zimbu
    Mister Zimbu:
    - What color is your car?
    tan
    - What state were you born in?
    agony

    So looking at the IKEA one, it looks like someone took the picture and added the letters afterwards (photoshop or any other program that allows you to put text on an image). The letters don't look at all like they were on the furniture when the picture was taken.

  • airdrik (unregistered) in reply to airdrik
    airdrik:
    So looking at the IKEA one, it looks like someone took the picture and added the letters afterwards (photoshop or any other program that allows you to put text on an image). The letters don't look at all like they were on the furniture when the picture was taken.
    Or was it a page out of a magazine or other ad where someone forgot to add the name and description (which means that part of the WTF is the lack of source information in the WTF description - keep it short, but not so short that whoever is looking at it can easily figure out what the WTF is)
  • Chandra (unregistered)

    I think the "Logon In" and "Logon Off" happened because of some misguided attempt at internationalization.

    They must have thought of <key for Log>+<key for In> and <key for Log>+<key for Off>. And someone went and defined key for Log to be Logon.

  • vtcodger (unregistered)

    "While trying to signup for a Windows Live account, I found myself without my best friend Neil," wrote Rob, "unfortunately, my second-best friend Ray, third-best friend Jane, and fourth-best friend Tom are also excluded."

    Clearly, those people are not your friends. You gonna ignore the computer and associate with them anyway?

  • The Nerve (unregistered)

    Tom is NOT my friend.

Leave a comment on “Logon-ing Off”

Log In or post as a guest

Replying to comment #:

Log Out

« Return to Article