Security

Someone shared this cool site on Hacker News: https://knock-knock.net/.

It’s a honey pot with the purpose of identifying malicious actors on the internet and then publicly sharing the list of their IP addresses.

Since I’m hosting my own site, I’ve seen how many bots are hitting my poor server. Number one on the list of 404 errors is a request to /wp-admin/install.php?step=1 – 10 times as many hits as the next entry. It’s clearly an attempt to pwn web servers whose careless admins left an uninitialized WordPress instance exposed to the internet.

This really needs to be said:

If you are generating passwords, do not include special characters.

That’s right, I said it. Passwords without special characters.

I know, countless password policies and recommendations from all kinds of places mandate the use of at least one special character in a password. But guess what, adding an exclamation mark at the end doesn’t mean you now have a good password.

This rule is a rule of thumb that is given to users who are generally non-technical to help them choose a better password. The idea is that if adversaries are trying to find a password from its hashed form using brute force, they must work harder the larger the alphabet that makes up the password. And that’s true. Except brute force rarely plays a role.