Taking over historically grown IT is hell
I’d happily use a passphrase with multiple unrelated 8-12 character words but for some reason most businesses have upper limits on how many characters can be used…
That is the character limit on the database field where they store your password in plain text.
And don’t allow spaces, for some unknown reason.
all this fuckin white space in your password keeps breaking my bespoke homegrown hashing algorithm you pleb
Rule #1 “don’t implement your own security/crypto code unless you are a security expert, and even then…”
It’s BESPOKE sir
Some sites require special characters in their passwords, other websites don’t even allow them. I use a password manager, but still have to tweak the password generation rule for some sites.
I think the worst case ive seen is a 16 character limit, not enforced at sign up, but enforced at login
This was Microsoft - for their online services such as Hotmail or Outlook.com or Azure - well into the 21st century. They first lifted that limit in 1999, then re-established that in 2012. They only re-reversed it back to a longer option (up to 256 characters) in 2019.
Like, morons.
I’ve seen this, fucking brutal UX lol
Sure, but it’s going on a sticky note taped on the bottom of my keyboard
Look at you with the heavy security. No need for that, right on the monitor should be fine. In fact to avoid confusion you should write ‘Computer PW: correcthorsebatterystaple’ so you don’t forget what the note is there for.
And more and more businesses are also limiting what characters you use, as well.
Like, my random generator uses characters from the entire European UTF-8 printable character set. This expands the number of usable characters from about 68-74 (the typical uppercase, lowercase, 0-9 & special characters) to about 1,200 characters. This includes all Latin, Cyrillic, and Greek variations used across Europe.
Just using the wider UTF-8 range nearly always doubles the bitwise complexity (as KeePass measures it) for passwords of the same length, if not more, thereby dramatically reducing the ability for the password to be brute-forced. Not to mention using characters that are not expected to be in passwords in the first place - most brute forcing simply doesn’t account for that where a primarily English-speaking victim set is concerned.
Plus, the passwords are not short. I usually prefer 32 characters, and in important/mission-critical services I expand it to 64 characters.
Oh there has to be an upper limit for things like buffer overflow or just plain RAM capacity limits. But even with allowing the max possible range of characters you are still looking at something like 100,000 in a single 1mb size and I’m sure they could manage to do that and still pass it along to a high quality hashing function.
If you try putting in a password longer than that yes reject it.
That is dumb bit what’s even dumber is disabling paste.
Correct Horse Battery Staple
I was setting up a service on my home server, and the default admin password was this, lol.
Also: reference for those who might be confused.
I prefer Incorrect Zebra Line Voltage Tape
Debatable Donkey Dynamo Duct-tape
Keep them on their toes. After hunting down the last of them it’s time to introduce multi-factor.
That’s the plan. Can’t wait for their faces…
Why would you do such things? Just let me log in using some trusted authenticator please. If you can’t do that, you may as well replace everything with a confirmation mail every time I log in, cause you bet I’m going to click “forgot my password” Every Single Time and get in via the reset-email anyway.
You forcing me to change my password all the time just adds extra overhead to the inevitability that you’ll let me in after mailing me a confirmation code.
Just use a damn password manager already
It’s their user password to get into their computers. Password manager won’t help there.
One one hand, password manager is useful to log-in into random ass web service which i use once a year to get one random file or whatever and forget.
On the other hand, i need to authenticate every time i use my computer, and i need to just know the password, not pasting it from password manager every time.
Most password managers stay open for a configurable amount of time, plus you can use hardware tokens for more convenient/secure unlocking. And having to remember the master password without it being stored anywhere but your brain is kinda the whole point
After you use the password 2-4 times you will remember it, so i think it’s totally worth it tbh
Yo dawg you got good memory. I can remember a lot of things but passwords aren’t one. When I had to make a GSA level password, after trying for two hours to make one. I gave up, mashed some shit in and wrote it on a piece of paper. I could be tortured and all I can say here are all the restrictions and try to make one yourself.
Yo dawg you got good memory
Dw, i’il forget about it if i don’t use it for more than 3 days which is why i have a copy of the password on a piece of paper i carry around
Well that’s always a good skill when you’re being asked to hand over your passwords =P Sorry forgot them.
This is topical because I just got one of these emails.
Nobody is going to bother guessing that I would be stupid enough to use a four character password. It’s good enough for my bank and my phone, so it’s good enough for my computer. (/s)
At least now they recommend pass phrases instead of words, but the examples were contradictory and they wrote all the words in 13375p34k
I let the users choose whether they want pass phrases or classic cryptic passwords. So far nobody wanted passphrases, because apparently they can’t do 10 finger system typing. Next step will be self-service passwords & MFA once we fixed the major issues around here.
That’s interesting.
I always found yubikeys cool
hmm. that many letters. ok. 1…2…3… ah 16. cool.
here we go:
Input new Password:
Sixteenpassword!
ERROR: you must include a number
there is a number in it you stupid machine.
*ERROR: Your password must have a minimum sixteen characters
Minimum_16_characters
*Your password has been accepted
My work has a mandatory password update every ~3 months, seemingly keeps all previous hashes, and some employees have been around for 20+ years.
I feel for the IT security team.
Mandatory password updates go against NIST standards
Clearly our company has set their own standards…
…this is also on top of 2FA, Zscaler, and a few other secure network requirements I haven’t fully poked around. 🤷🏻♂️
We regularly work with a tonne of sensitive and PII data, such that even one leak would be disastrous.
So some of them must be up to around hunter62 or so…
Weird, that’s just showing up as ******** to me…
If you’re not using a password manager in 2026 wtf are you doing
The key is to allow a password manager but require a unique password to view each entry
Lol
… Remembering every password?
Jk I probably should, but I’m slightly conspiratorially minded on account of being proven right by Facebook and apple and Spotify and google and…
Use an offline one you can store it on an encrypted usb
On my list after I properly figure out how to play Minecraft beta version fully independent from Microsoft
confused cert-token + password noises
I like how some websites just gave up on passwords.
Fun password trick:
Pick an adjective, a color, an animal, and a cuss word.
Now pick 2 numbers and a special character, or 2 special characters and a number.
Separate your 4 words with your other 3 items and, boom! 12+ character password that you already remember.
Bonus points: lose the numbers and characters and you have a hilarious insult.
I make up a sentence and then I write it out. Why limit yourself to 12 characters?
Like the actual phrase
Why limit yourself to 12 characters?
is a very strong password, easy to remember, fast to type and has the added benefit of not containing any adjectives.
Length and complexity are the two most valuable things in a password.
“ThisIsMySuperCoolPasswordNoOneWillEverGuess#2!0” is an insanely good password. “G<7p8*a94;B” is pretty good too but howtf are you gonna type that every time
It’s a nice idea, but random passwords are quite a bit safer than any manually created password. We use password generators for that. Some of them also support passwords that can be pronounced. In some way, anyway, because the “words” make no sense.
Though, i’m still waiting for someone who would accept a passphrase.
Holy shit it happened, someone chose the passphrase
Do you work for the FBI?
girthyGreyDogFucker69!
What does the age of my dictionary have to do with anything?
The Plague: Someone didn’t bother reading my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and…
Margo: [glares at The Plague]
The Plague: god. So, would your holiness care to change her password?
(Hackers 1995)
*passkey
fourwordsalluppercase
