I am implementing the password hint code + password I want the user to not prompt the password hint to immediately open the actual password.
Here is the scenario I want to prevent:
Assume password: foobar123
Then the password hint cannot be:
- "foobar123"
- "Password: foobar123"
- "foobar-1-2-3" (or any other x len delimiter)
- "f00bar123" (replace o with zeros)
a few questions:
- Am I going overboard with this? Should I allow users to pay a price for not being aware of security?
- Am I missing an obvious scenario that I need to prevent as well?
- ? , .