armabiz

Just one thing taken from the article comments:

> HTML used as the screenshot is as horrible as article.

+1

Dear %username%, thanks for reporting this critical security vulnerability, affecting our multi-million business.

Do you want a T-shirt?

Your password has expired :)

I would also add to this statement that this shouldn't be user's problem, but service problem. By forcing setting strange passwords services transfer their problem to secure passwords to user's shoulders.

Instead of following shitty password rules in forms, it's better to make it very hard or expensive to brute-force these passwords. So any heuristics to identify ubnormal/dangerous activity and take an action by decreasing attacker chances like rate limiting/captchas and so on.

  * If you see one IP trying to login with incorrect creds with really high rate - then it's probably attack.
  * If you see really lots of IPs trying to crack specific user account at the same time - then it's probably attack.

Instead of that I can see the opposite practice: service set draconian password politics, but just allow requests with incorrect credentials without any limits: "30req/sec? You're welcome, buddy! Need an API maybe?"

I can suspect something like this happened before:

"It looks like a lot of work with rate limiting and all the stuff, let's just force our users to set 10+ character passwords with one+ capital letter, one+ number, one+ special character". Oh, and in these examples there is usually cherry on cake like:

  - Dev1: "Let's not allow 2 same characters or 3 characters of same type"
  - Dev2: "Let's also force our users to change their passwords every 3 months"
  - CEO: "Brilliant ideas! We're secure now!"

These surprises are up to every developer's/another genius infosec imagination :)

So, my conclusion is that best security systems should be almost invisible to normal users and let attackers screaming.

Surprised of 99% agreement here at HN, because usually IT/security people in majority of the cases don't understand me when saying ^^ the same.

This is just one of those examples where experienced freelancer will see flag "avoid!" for such kind of clients.

The truth is that places like odesk/up work/anything is just big market. There are clients willing to hire low-rate developers and micro-manage them, but at the same time there are clients who want to hire top talents from the marketplace to deal with complex tasks and get really top solutions.

Somehow I could find really interesting work in high-load startups with 4M visits/m, OpenSource or even Y-combinator startups with good culture.

To be clear, during ~10 years of experience I was at both sides of barricades: hiring developers/designers/marketeers and being software developer/freelancer myself.

So it's just experience grew into skill when you had all that shit like non-paying/rude/time wasting clients and feel how to avoid that.