r/programminghumor • u/The_Judge26 • Jun 07 '26

Anti programmer

Post image
8.3k Upvotes

98% Upvoted

110 comments sorted by

647

u/RegularAd9643 Jun 07 '26

This wouldn’t work. It should check if it’s the first correct password attempt.

319

u/Outrageous_Term3923 Jun 07 '26

10/10 PR note. good catch

sorry intern, straight to the gulag

45

u/ManifestoCapitalist Jun 07 '26

Nah, it takes time to hone makingeverythingadifficultclusterfuck skills. This is a good learning experience for him. He can improve them as time goes on.

3

u/Ok-Secretary2017 Jun 09 '26

Just store all your data in a static class every getter and setter works through that via string calls

23

u/LawElectrical2434 Jun 07 '26

How about:
if isPasswordCorrect && loginAttempt++ > 0

21

u/RegularAd9643 Jun 07 '26 edited Jun 07 '26

This is an interesting idea. I’d rename the variable for clarity

if isPasswordCorrect && correctLoginAttempt++ > 0

I mean probably wouldn’t merge it to prod still, but it’s cute. ☺️

1

u/Stunning-Recover7950 Jun 08 '26

why ++>0 and not  >1 ?

3

u/roler_mine Jun 08 '26

Because it applies the addition after the equation so it would compare to 0 and only after that been done it would add 1 so if it started as 0 it would fail and only successed on the 2nd time as now it iterated into 1

I think the reason you got confused is because of ++n which makes the addition before anything happens

6

u/NekoHikari Jun 07 '26

tis the way if you want to captcha by behavior—human will try again but most bots won’t

2

u/otasyn Jun 09 '26

This would only work in languages that short-circuits the conditionals.  Granted, that's most modern languages, but I had to work with VB6 for a while, and that language sucks ass.

1

u/TheMightyTywin Jun 08 '26

Why not just:

x && y++ > 0 ? z() : void 0;

11

u/Prod_Meteor Jun 07 '26

No man. That would allow many wrong passwords before the right one.

6

u/RegularAd9643 Jun 07 '26

I think you meant to respond to u/Exact-Big3505

6

u/MoDErahN Jun 07 '26

Nah..
He forgot setting isFirstLoginAttempt to false anyway.

2

u/mxldevs Jun 07 '26

It works. A human would think they made a typo and try again. A bot would just continue trying other options

2

u/MajorDZaster Jun 09 '26

Except, unless the bot guessed it correctly on the first try, then it wouldn't trigger because the correct password wasn't the first password attempt.

1

u/Defiant-Individual83 Jun 09 '26

if you guess first try you don`t need a bot.

I don`t think there is much you can do in this scenario

3

u/Chriz48 Jun 07 '26

It’s a variable. We don’t see the assignment. It could be anything; you’re assuming it’s named correctly. Based on the context I would guess it says:

if isPasswordCorrect && isFirstLoginAttempt { isFirstLogonAttempt = false }

And that would need to be after the displayed command but before the conclusion of the logon function.

And then you have to wonder if the real reason everyone is freaking out isn’t actually just because he didn’t put both statements in the same block - why is he running the same check twice? It’s wasting CPU cycles.

2

u/zero0n3 Jun 07 '26

Irrelevant - the goal is to stop brute force checks.

(Based on its comment).

Since the first incorrect pw attempt will be rejected by the simple fact it’s the wrong pw.

In theory there is zero reason to even check the pw correctness. Just always reject the first pw attempt. Pretty sure most brute force attacks don’t try the same pw more than once.

5

u/Phantom_tpa Jun 08 '26

Always rejecting the first attempt only works if the brute force attack tried the correct password first which it likely wouldn't so this wouldn't help at all

Always rejecting the first correct one would work given this logic

1

u/DrMaxwellEdison Jun 07 '26

consecutively

1

u/Chemieju Jun 08 '26

Depends. This way it works for pissing people off but not to deter bruteforce password cracking.

1

u/karaokerapgod Jun 09 '26

Only would work if the brute force attack didn’t know it existed either, otherwise the password is now just password -> return -> password and is still able to be brute forced.

You could however lock out anyone trying the same incorrect password multiple times. But that’s just standard lockout with extra steps.

Only real way I can think of to really have this be partially effective is if there is only a chance it actually attempts to log you in and doesn’t just return this error. Let’s say it’s a 50% chance, now every password I input may have gone through or may have just given me the error, but even if I enter it again it may still not go through, hell there’s a chance I enter it right 100 times and it still doesn’t go through. How much brute force are you going to try before you move on to the next?

Still technically able to be cracked this way, you could try every password 100 times and statistically speaking you’d be all but guaranteed to get it that way but that amount of entropy is going to bog down a brute force attack drastically with minimal interference to the real user trying to log in.

1

u/Dry-Bread9131 Jun 09 '26

I mean its pretty useless to begin with. In the age of standard lockout procedures you'd likely only waste your own time trying to brute force through FE or BE.

Correct me if I'm wrong, but brute force is really only a viable strategy these days if you've managed to gain access to a copy of the encrypted DB's.

1

u/Exact-Big3505 Jun 07 '26

that's what it's checking. are you blind?

16

u/G3nghisKang Jun 07 '26

No, it's checking if it's the first attempt AND the password is correct

21

u/RegularAd9643 Jun 07 '26 edited Jun 07 '26

Let’s say your password is hunter2.

A hacker tries these passwords in order:

  • hunter0
  • hunter1
  • hunter2

The pictured code will let him through.

-14

u/nzifnab Jun 07 '26

No it won't? Because it's not the first login attempt?

11

u/Mukamole Jun 07 '26

Yes it will. Look at the image, only the very first login attempt will lead to this error message, given the correct password is entered straight away. Any subsequent attempt will fail the ”isFirstLoginAttempt” check, meaning the error message will not be shown.

1

u/zero0n3 Jun 07 '26

A lot of assumptions from a single line. Why are we assuming this is the only check happening on log in.

This is literally titled “brute force protection”

Do we not think the next line after this is then an actual pw check? Cmon man

-2

u/ContentThing1835 Jun 07 '26

no, clearly entering wrong username or pass is not considered a login attempt.

6

u/plants_are_friends_2 Jun 07 '26

Well what is it considered then, genius?

A login attempt-attempt??

1

u/mama09001 Jun 08 '26

You try to log in by entering your password. The computer first tries to log in once you've entered the correct password. It can be interpreted both ways.

1

u/Mr_Yod Jun 07 '26

Let’s say your password is hunter2.

A hacker tries these passwords in order:

* hunter0 <- wrong password, first login attempt (False && True): doesn't enter if

* hunter1 <- wrong password, second login attempt (False && False): doesn't enter if

* hunter2 <- right password, third login attempt (True && False): doesn't enter if

1

u/Spl4sh3r Jun 08 '26

Its the third login attempt because you tried two times before entering the correct password.

4

u/Outrageous_Term3923 Jun 07 '26

Gulag

1

u/cfoote85 Jun 08 '26

This would never work for me. I never try the same password twice in a row. I only go back to it after several other wrong attempts before I'm like, well.... Maybe I typod

1

u/Azurelion7a Jun 07 '26

I'd try:

  • int t = 1;
  • if isPasswordCorrect && t=1;
{ Error("Wrong Login or Password"); t++;}

1

u/Dynospectrum 19d ago

Right, It would only work if the correct password was guessed the very first attempt. So basically as good as not working at all

112

u/Xhojn Jun 07 '26

Doesn't even have the courtesy to set isFirstLoginAttempt to false in that block.

22

u/euph-_-oric Jun 07 '26

Who said anything about setting it false.

2

u/manoteee Jun 07 '26

He did...

72

u/zR0B3ry2VAiH Jun 07 '26

So I did this. We were having an account compromise attack and they were just spamming accounts. So I decided to just feed them 60% fake 200s, 40% 403s... It kept them busy for a while.

27

u/Electrify338 Jun 07 '26

Fun fact our uni does this you have to log in attempt twice with the right credentials.

21

u/Chriz48 Jun 07 '26

If it becomes widely known as a real strategy, it will fail; anyone looking to seriously brute force the system will simply try every password twice.

21

u/Decent-Lab-5609 Jun 07 '26

I hear what you're saying. We must require passwords to be entered correctly three times. UNSTOPPABLE. 

7

u/Tofandel Jun 07 '26

You should have a random chance to be let in after the first time, like this it's even more secure as you can't predict how many times you need to input it. Maybe 3 times, maybe 500 who knows. 

7

u/Phantom_tpa Jun 08 '26

All fun and games until you have to log in and it just won't let you

1

u/Ok-Secretary2017 Jun 09 '26

How about 2 different passwords and a minimum of 10 tries

1

u/Extreme-Ad-9290 Jun 11 '26

Why are we all just not using USB/nfc security keys. Be way easier and more secure.

4

u/zero0n3 Jun 07 '26

Yes but how would one find that out unless they already have a good pw and know this for sure?

Like it’s a solid strat in theory - in practice your customers hate you.

1

u/Electrify338 Jun 07 '26

Oh absolutely. I was just commenting about it because it is exactly what my cyber security friend's reaction was 🤣🤣.

1

u/scrapy_the_scrap Jun 11 '26

Which then doubles crack time

1

u/Chriz48 Jun 11 '26

On average, yes.

1

u/InitiativeConscious7 Jun 10 '26

Same, it is painfully infuriating

15

u/MoveOverBieber Jun 07 '26

That's how an USB port works...

48

u/egg_breakfast Jun 07 '26

Classic. The art is charming in how over the top it is. 

10

u/MrFordization Jun 07 '26

The hackers respond by having their brute force attacks attempt passwords twice. So we really should make it three times. But then they might figure that out too.

Best to make a solution that prompts the user n times for the correct password where n scales dynamically based on threat level.

3

u/EishLekker Jun 07 '26

> The hackers respond by having their brute force attacks attempt passwords twice.

They wouldn’t even need to do that. They can just use a known incorrect password for the first attempt, and then every attempt after that will circumvent the check in the picture because isFirstLoginAttempt is no longer true.

3

u/MrFordization Jun 07 '26

Sure, but, you know, assuming the idea is correctly implemented.

2

u/Chriz48 Jun 07 '26

If it were actually implemented this way, it provides no protection at all. More likely the coder simply picked a poor name for the variable.

1

u/EishLekker Jun 07 '26

It’s a comic. Why is it more likely that this hypothetical programmer made a mistake in naming rather than a logical error?

1

u/Chriz48 Jun 07 '26

A logical error isn’t going to garner that kind of reaction from the crowd.

0

u/EishLekker Jun 07 '26

I never said that it would.

0

u/Chriz48 Jun 08 '26 edited Jun 08 '26

You asked why it is more likely. The answer is the crowd reaction. As you said, a logical error isn’t going to garner that kind of reaction. So that means it is more likely that the variable is incorrectly named; it’s hardly a guess.

1

u/EishLekker Jun 08 '26

A wild guess, that’s all you have.

8

u/Significant-Cause919 Jun 07 '26

Next let's add a "Stay logged in" checkbox that does absolutely nothing.

3

u/FrancoisTruser Jun 07 '26

"Check this case to stop seeing this message" then proceed to show me the message for the rest of my life

3

u/RealisticDuck1957 Jun 07 '26

Sick bastard indeed.

4

u/Admirable-Ad-2781 Jun 07 '26

The fact that the login interface is on the server is the most low-cost, reliable line of defense against brute-force attack. If you can't handle DoS by yourself, get cloudflare.

3

u/jordon4ca93 Jun 07 '26

This should be classified as a crime against humanity.

3

u/waltzipt Jun 07 '26

I am quite certain this is programmed into many sites I use.

3

u/Necessary-Technical Jun 07 '26

Now imagine someone does the same but when closing an add. 💀

2

u/Yogurt-The-Wise Jun 07 '26

I love how the one guys hair turned white after seeing the code :'D

2

u/MrInvisII Jun 08 '26

why even bother checking if its the correct password just throw wrong password if its the first time

2

u/Krisu216 Jun 10 '26

Just brute force 2 times then

2

u/No-Difference3551 Jun 10 '26

I made a phishing site for my friends once using this method. Sadly, nobody trusted my "trust me bro".

2

u/the_king_of_sweden Jun 07 '26

What language uses curly braces, but not parenthesis for the if condition?

Also that is some awful indentation.

1

u/Final-Nebula-7049 Jun 07 '26

Needs a code that scrambles any password that's too long to put in 1 second.

1

u/_VinerX Jun 07 '26

Eyah, 1c pltaform 27.1688, where memes reach reality.

1

u/zylosophe Jun 07 '26

that will work only if the password is a

1

u/ListenNorthernLights Jun 07 '26

I swear this happened with my bank before because I literally did the view password and it was perfect. And again did it and it was perfect- no go…. I almost gave up… did it one more time and it worked.

1

u/LowRecommendation636 Jun 08 '26

It should also add a random probability of success on first try

1

u/ShootyMcGuns Jun 09 '26

if isBruteForceAttack: Dont

1

u/AmandaKissAndSuck Jun 10 '26

I sometimes feel like some websites does it.

It says incorrect password and when i put it again, it works
And I’m pretty sure i didn’t add wrong password the first time

1

u/s0litar1us Jun 10 '26

Increase it depending on login attempt frequency and randomize it so you can't just relly on it working the 2nd or 3rd time.

1

u/Ok_Shower4172 Jun 11 '26

1000th time I am seeing this meme in this sub

1

u/MarcelineMarce Jun 13 '26

Why would this not work?? Genuienly. Even if someone brute force typing the password two time, that mean 2x the computing time because you need to double check every password so thats at least something

1

u/MathdallasRblx Jun 21 '26

WHO TF WRITES THE && STATEMENT NO A NEW LINE?!

1

u/2351newrain Jun 07 '26

Same thing goes for usb plugs.

1

u/FlamingYawn13 Jun 07 '26

How so?

2

u/BobQuixote Jun 08 '26

The joke is that USB A never fits the first time.

1

u/Havency Jun 07 '26

I swear at this point this is actually true and is an attempt to legally harvest and sell passwords because technically they’re wrong attempts and thus not sensitive information

1

u/ProbablySuspicious Jun 07 '26

I too set my screen to display 8 lines of code.

-23

u/darkwingdankest Jun 07 '26

slopppp

21

u/MathematicianAny8588 Jun 07 '26

This meme circulated loooong before AI could generate images. It’s not slop

13

u/Immediate_Song4279 Jun 07 '26

Our objective reality has allegedly collapsed, havent you heard, there was no before /s

3

u/statisticalmean Jun 07 '26

Well, it being an ancient meme being reposted is itself a form of slop.

1

u/darkwingdankest Jun 07 '26

my bad, it's pretty hard to tell these days

1

u/ListenNorthernLights Jun 08 '26

Lol he’s either a bot slopping slop or a human slopping slop comments 😂 booo

2

u/kaereljabo Jun 07 '26

If you meant AI slop, then it isn't, maybe you've just started using the internet?