90 percent of everything : Usability Blog

Written by Harry Brignull

I’ve finally got a copy of Vista running at home. I’m mainly going to use it as a Media Center and I’d like to say that there’s lots of thing I like about it. I’d like to say that because I’m probably going to spend the next few months bitching about it

Number one. It does look pretty. That’s the first time I’ve said that about a version of Windows since i spotted Windows 3.1 in the window of Dixons (and that was coz I’d never seen a 256 colour graphics card before)

Number two. I’m judging it as a media center. That means the whole 10 foot interface with no mouse or keyboard. And in that field there isn’t much competition. Nothing Apple is doing? (Please correct me…)

Number three. I’ve got way too many music files. Vista isn’t doing that well at not choking on my music library. That kind of sucks but I’m going to let it go. I’m not a typical user and I’ll have to fight this battle some other time.

Ok I acknowledge that I’m no security expert and this probably isn’t a major security risk, but do you recognize this scenario?

You’re on some two-bit website trying to log in. Maybe its a royalty free photo bank, maybe a discussion board, or some random online game.You’re in a hurry, not thinking too hard, and suddenly find you’ve tapped in the username and password for your email account, or – even worse – your work VPN. It comes up as “incorrect username / password” so then you go on to try another likely candidate – and then another again. By the end of it you’ve hammered in pretty much every username and password you’ve used in the last 10 years.

Have you ever considered the possibility that this site is storing all the rejected username and passwords? They may be storing them with or without nefarious purposes, but either way, it’s a genuine possibility. It seems reasonably possible that if you were a nasty person, this kind of list would be useful for a dictionary attack. I’d love to be enlightened by an expert on this stuff.

Password security seems to be primarily a human problem… I’m no expert but I’m really intrigued to read more about this…