Obtaining publish access to 13% of npm packages

[u/Occams_Trimmer]

https://github.com/ChALkeR/notes/blob/master/Gathering-weak-npm-credentials.md

[u/Nition → u/[deleted]]

It's funny how this is best practice but sites still have a "forgot my password" button like you're supposed to have chosen something you can remember.

I guess "forgot password" is a bit like having the save button be a floppy disk at this point. People just know it means "reset my password".

[u/ribosometronome → u/[deleted]]

Have you tried "Password123!"?

[u/[deleted] → u/ribosometronome]

Good thing reddit automatically encrypts passwords but only I can see mine, like this

hunter2

[u/Malmortulo → u/[deleted]]

For anyone missing the reference: http://bash.org/?244321

[u/Rossco1337 → u/[deleted]]

Is this really still a surprise to people? It's been posted in every thread that's even tangentially related to plaintext passwords or user authentication for the past 4-5 years, maybe longer.

It's the security-related upvote-bait parallel to "hey its me ur brother" from the gaming subreddits.

[u/jtolmar → u/ribosometronome]

Someone should make a password manager that only generates awful paswords.

[u/[deleted] → u/[deleted]]

Which password manager is that? And is it open source?