Obligatory https://neal.fun/password-game/
Well, that’ll teach you to actually take care of your pets and not just dump their food in front of them and be done with it.
(fuck paul tho fr)
I closed my laptop when it asked for the Wordle of the day.
Enter the same thing 5 times and you’re good for the day :)
This game made me so angry haha
Best practice in 2023 is a simple, sufficiently long but memorable passphrase. Excessive requirements mean users just create weak passwords with patterns.
[Capital letter]basic word(number){special character}Enforcing password changes doesnt help either. It just creates further patterns. The vast majority of compromised credentials are used immediately or within a short time frame anyway. Changing the password 2 months later isnt going to help and passwords like July2023!, which are common, are weak to begin with.
A non expiring, long, easily remembered passphase like
forgetting-spaghetti-toad-box
Is much more secure than a short password with enforced complexity requirements.Drop “memorable”. 99.9% of your passwords should be managed by your password manager and don’t need to be memorized. On one or two passwords that you actually need to type (like your computer login) need to be memorable.
99.9% of your passwords should be managed by your password manager
this looks like a sensible approach until you remember password managers can be cracked, too. I’m with GP on this, a passphrase is easier to remember and is good enough for most use cases, if you need more security you should be using some form or another of 2FA anyway
forgetting-spaghetti-toad-box
I don’t know much about PW security but would a passphrase of common words not be more susceptible to dictionary attacks?
Infuriating fact: if a service has maximum password length limits (lower than 1000 characters), they’re reversibly storing your password and if they’re that lazy it’s probably plain text
reversibly?
Yeah, you actually better not save the users passwords in plain text or in an encrypted way it could be decrypted. You rather save a (salted) hashed string of the password. When a user logs in you compare the hashed value of the password the user typed in against the hashed value in your database.
What is hashed? Think of it like a crossfoot of a number:
Let’s say you have a number 69: It’s crossfoot is (6+9) 15. But if someone steals this crossfoot they can’t know the original number it’s coming from. It could be 78 or 87.
i was more wondering why a length limit implies anything about how they’re storing the password. once they receive the password they’re free to hash it any which way they want
random memory—yahoo back in the day used to hash the password in the browser before sending it to the server, but TLS made that unnecessary i guess
Dumb question: isn’t it irrelevant for the malicous party if it’s 78 or 87 per your example, because the login only checks the hash anyway? Won’t both numbers succesfully login?
It’s actually a really good question. What you’re explaining is called a collision, by creating the same hash with different numbers you can succesfully login.
This why some standard hashing function become deprecated and are replaced when someone finds a collision. MD5, which was used a lot to hash passwords or files, is considered insecure because of all the collisions people could find.
In the example yes.
In the real world, finding an input that produces the right hash output isn’t easy. And because a lot of users reuse passwords (don’t do it, but people do), a list of emails and passwords gives you an incredibly lazy and easy to do way to compromise accounts on other sites.
Reminds me of a funny moment in my IT internship, ahead of an audit one of the sysadmins came over and was saying “yeah so I pulled all of the department password hashes to check for weak/compromised accounts and noticed one person has the same sysadmin and user password hash” and my boss went “wait everyone doesn’t do that?” And after realizing they outed themselves turned bright red and changed their admin password
In the least bad case, they encrypt the password instead of hashing it, making it possible to decrypt the password.
In the most common case, they store the password in plaintext, so there isn’t even any encryption to be reversed.
Couldn’t it just be that they’re using something like bcrypt which won’t take any chars above its limit into account (knowing that there’s a limit will pretty much never matter to a user but why obscure the fact)? What does it even mean to store it reversibly, just because they have a char limit doesn’t mean they are encrypting the password, could just be some frontend shenannigans as well.
Fun fact: Lemmy instances cap at 60. they’re not storing reversibly, they’re just using bcrypt and rather than pre-hashing the pw before bcrypt like most bcrypt users do, they just truncate to 60.
60 makes sense, 14 does not
Nope. No point in storing > 256 or even 128 chars for a password anyway. Useless storage wasted. Also it doesn’t really mean they store the password badly in the server.
Ignoring that they must be hashed to be acceptable and that it’s not possible for 1000 characters of text to add up to a waste of storage worth mentioning in pretty much any environment, it’s literally impossible for a 128 character password limit to be beneficial in any way.
A limit below that demonstrably lowers security by a huge margin.
Ok but are 15 characters too much?
I’ve seen 14-char limits, which are NOT reasonable
I don’t get why some sites limit your usage of special characters and have miniscule max lengths?? looking at you PayPal you piece of shit
“This password would take 1 century to crack!”
There was a website where I was making an account and it was like: no semicolons.
To this day I wonder if that was how they blocked sql injection.
Escaping by obstruction ^^
password is already in use
No way that’s an actual security threat, right?
Knowing that it’s already in use is.
Basically all of these constraints are bad practice, though. It’s obviously better to have a long, complex password, and not to reuse passwords between sites, but if you make shit impossible for people to remember they’re going to write it down, and a lot of people don’t use password managers (or use shared devices where they aren’t possible).
Length limits (that aren’t like 1000 characters) are unconditionally terrible practice. It means your password is probably plain text, because hashes don’t really care or take meaningfully longer based on the length of the input.
A string of (random) words is a perfectly fine password. There’s an xkcd I’m too lazy to get demonstrating it, but it genuinely does add enough randomness to break brute force.
The only security threat would be the site itself. How do they know other users have the same password?
Options:
-
They have your password in plain text in their DB. CHEFF KISS
-
They aren’t using salts.
-
They are using the same salt for everyone.
All of them concerning.
-
The right answer is use a password manager to generate and store a long password. Then it doesn’t matter.
If for some reason you want a secure password and aren’t using a password manager https://www.grc.com/passwords.htm
Fuck that shit, just give me the password
Does anyone use the generator from chrome anymore? Like a 2023 password for me is “suggest strong password”…
Remides me of https://neal.fun/password-game/
That was my immediate though too!
