• I Cast Fist@programming.devEnglish
    3·
    7 hours ago

    Let me write a fucking passphrase instead of ABCabc123! And let me use fucking ã, ñ, é, ç, etc on my passwords - Microsoft doesn’t allow spaces or latin special characters

    Forcing people to use upper case, lower case, number and special character is terrible for them and vastly increases password reuse. Besides, almost no one brute forces anything anymore, it’s all rainbow tables and invading the database server

    • WanderingThoughts@europe.pubEnglish
      24·
      16 hours ago

      Then you can generate a password so big and complex, the site or app starts begging you to stop. At that moment, you can say “ur password system is weak.”

      • bdonvr@thelemmy.clubEnglish
        29·
        16 hours ago

        Careful with that. Sometimes a site will allow you to use some stupid long password when you sign up, but then it turns out that some other version of the site or an app for it on other platforms won’t accept a password that long!

          • devfuuu@lemmy.worldEnglish
            1·
            10 hours ago

            It just says “wrong password” and you’ll be guessing at which random character did it cut the password. Luckily sometimes it’s just a stupid html verification form that can be disabled in the console and be submitted anyway.

        • markz@suppo.fiEnglish
          3·
          15 hours ago

          I mentioned lemmy passwords in the other reply. Guess how I found out

      • fuck_u_spez_in_particular@lemmy.worldEnglish
        3·
        8 hours ago

        Arghh, why is every company thinking, that AI will make them valuable…

        “Let AI retrieve, generate and manage all your credentials”

        Yeah a definite nope, for what reason do I use bitwarden? So that exactly this doesn’t happen…

        Anyway vaultwarden is what I’m using, much more performant and self-contained, compatible to bitwarden (but you need to host it, obviously)…

        • Cassa@lemmy.blahaj.zoneEnglish
          41·
          16 hours ago

          It’s not a service you’re paying for. It is just a password manager.

          Though tbh, I don’t know all of bitwardens spesific details.

          It’s at least open source, but can you have your passwords stored anywhere other than their servers? What if the company changes path - can you just use another fork or are you stuck.

          • markz@suppo.fiEnglish
            14·
            15 hours ago

            Bitwarden is self-hostable and foss, with some unofficial software already out there. Not much opportunity for the company to entrap customers if it went evil.

            IMO, for most people it’s best to just send them to register at bitwarden. It’s less hassle so they might actually follow through, while being infinitely better than what they were doing before.

    • AlfredoJohn@sh.itjust.worksEnglish
      44·
      15 hours ago

      Or just use the built in password managers in chrome or Firefox. No need to pay for a password manager when they are free on the browsers most people already use

      • markz@suppo.fiEnglish
        7·
        14 hours ago

        No need to pay

        I didn’t say anything about paying. It’s free in both meanings of the word.

        It’s also cross-platform and -browser and better than builtin ones.

        • AlfredoJohn@sh.itjust.worksEnglish
          2·
          4 hours ago

          Fair enough but both the chrome and Firefox password managers are cross platform and can be exported and imported supporting the ability to move away from them in the future should you choose. So for a first step from having insecure passwords to a password manager that gives strong passwords for someone who doesnt even want to rema strong password in the first place, they are good steps in the right direction. Don’t let perfect be the enemy of good.

      • Stillwater@sh.itjust.worksEnglish
        3·
        12 hours ago

        I wouldn’t recommend that. Bitwarden is free and works on any device, and doesn’t tie you to a browser. What if you want to switch browsers someday?

        • AlfredoJohn@sh.itjust.worksEnglish
          0·
          4 hours ago

          I mean the post is about people who dont want to put in effort to remember a good password, the path of least resistance here is still a good one. It’s not like the built in password managers are bad. With Firefox you can import from chrome and I believe you can also export the passwords if you wanted to move away from Firefox anyways. It’s not like you are locked away for good.

          • Stillwater@sh.itjust.worksEnglish
            1·
            2 hours ago

            I started with a browser password manager, and when I needed to change browsers it was an extreme pain in the ass to move everything.

        • Lag@lemmy.worldEnglish
          6·
          10 hours ago

          Same as wanting to switch password managers some day. Firefox has been the most consistent thing in my life.

          • T0RB1T@sh.itjust.worksEnglish
            1·
            3 hours ago

            Bitwarden is great! However, Keepass(XC) can do autofill as well.

            The only complication is keeping sure your cloud copy is up to date, or your machines are all kept in sync without conflict with something like syncthing. I actually really like the ways you can tweak KeepassXC.

    • Björn Tantau@swg-empire.deEnglish
      46·
      17 hours ago

      Yes, but that would involve choosing a password manager, setting up the password manager, learning how to use the password manager and remembering to use the password manager.

      • decipher_jeanne@lemmy.blahaj.zoneEnglish
        13·
        16 hours ago

        That’s easy, have your bi yearly over fixation on privacy and suddenly you’ll be setting up a custom VPN instead of doing your laundry. Fuck I forgot my bedsheets again

  • outhouseperilous@lemmy.dbzer0.comEnglish
    153·
    14 hours ago

    Correcthorsebatterystaple (somebody link please)

    Edit: Most places wont allow it due to character requirements and length limits, but it does work and is cryptographically sound.

    • Patches@ttrpg.networkEnglish
      4·
      14 hours ago

      Yep and then they require you to put special characters, numbers, and capital letters because… Reasons?

      I would be the one getting hacked, not them… Let me do what I want.

      • Ghoelian@lemmy.dbzer0.comEnglish
        2·
        10 hours ago

        It’s just because of entropy. More entropy is more secure.

        Also sure, it’s you getting hacked, but it’s the service that got hacked that will have all kinds of news stories written about their weak password requirements.

      • outhouseperilous@lemmy.dbzer0.comEnglish
        2·
        14 hours ago

        Also, chbs without aA!%12345ing is way harder to inject code with.

        Not that anyone is allowed to code considerately and well anymore.

  • PotatoesFall@discuss.tchncs.deEnglish
    14·
    18 hours ago

    I don’t know how but I went way too long without a password manager. Changed my life. I recommend Bitwarden. I also use it to store like, my bank account number or my tax number.

        • OpenStars@piefed.socialEnglish
          1·
          14 minutes ago

          It would seem so, yes.

          Evidence: xkcd is never wrong. :-P

          (Although I have always wondered about that aspect yes… perhaps an attack has to switch between trying random letters and random words, which may limit its effectiveness, and still keep the number of words high? What if we swapped out letters like c0rr3ct? - b/c obviously hackers have never heard of 1337 5p33ch before. Yeah I really have not looked this one up, hence default to the joke answer above. irl I use the FOSS KeePass and a large string of random crap… but that is nowhere near as funny to say as correct horse battery staple:-D

          Also, https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength does talk about this - but unless it is in the references, there is not too much depth there, e.g. a dictionary may have a certain number of words, but I doubt that they are all used equally - some werds oft encroaches upon my visage with verily greater frequency of occurrence by comparison to alterity, so while in the sense of spherical chickens sliding on a frictionless surface a dictionary attack “may not be viable”, in practice I highly suspect that a way could be found to find, if not one specific password, then at least somebody’s password within a large bank of them.)