Yep

all 46 comments

sorted by: hot top controversial new old
[–] 1 point 1 year ago

This legit made me choke on my laughter. So fucking true.

And then people go "jUsT wRitE iT dOwN"

Well, I do, bish, but I can never remember what notebook or piece of paper I wrote it on nor where I put it. I have found old password notes in the weirdest places, even digitally. In fucking Procreate on my iPad in a a weird folder I never use, quickly scribbled down in a file that I have not looked at for three years. Sometimes in the bottom of a bag that I put in the basement months ago, on a little water damaged poster it note. Other times in the back of a notebook, upside down AND written in invisible ink. No really. And I thought I was sooooo clever at the time too. -_-

So now I have a bullet journal I carry with me everywhere and I wrote down all the pin codes and passwords and whatever the fuck I have that I can remember down on a separate piece of paper that is in pocket in the back of the book so that when this journal is finished, I can put it in the next one. I hope this time it will work out longterm, lol.

  • source
  • [–] 1 point 1 year ago* (last edited 1 year ago)

    Ok but I'm not losing all my passwords if I lose just one or if my manager breaks. Safety over security smh.

  • source
  • [–] 27 points 1 year ago

    password managers save my life very hard

  • source
  • [–] 19 points 1 year ago (3 children)
  • [–] 5 points 1 year ago (2 children)
  • [–] 3 points 1 year ago (1 child)

    So, are we just going to pretend dictionary attacks don’t exist?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    It would seem so, yes.

    Evidence: xkcd is never wrong. :-P

    (Although I have always wondered about that aspect yes... perhaps an attack has to switch between trying random letters and random words, which may limit its effectiveness, and still keep the number of words high? What if we swapped out letters like c0rr3ct? - b/c obviously hackers have never heard of 1337 5p33ch before. Yeah I really have not looked this one up, hence default to the joke answer above. irl I use the FOSS KeePass and a large string of random crap... but that is nowhere near as funny to say as correct horse battery staple:-D

    Also, https://www.explainxkcd.com/wiki/index.php/936:_Password_Strength does talk about this - but unless it is in the references, there is not too much depth there, e.g. a dictionary may have a certain number of words, but I doubt that they are all used equally - some werds oft encroaches upon my visage with verily greater frequency of occurrence by comparison to alterity, so while in the sense of spherical chickens sliding on a frictionless surface a dictionary attack "may not be viable", in practice I highly suspect that a way could be found to find, if not one specific password, then at least somebody's password within a large bank of them.)

  • source
  • parent
  • [–] 14 points 1 year ago

    I don't know how but I went way too long without a password manager. Changed my life. I recommend Bitwarden. I also use it to store like, my bank account number or my tax number.

  • source
  • [–] 45 points 1 year ago (27 children)
  • [–] 33 points 1 year ago (9 children)

    Then you can generate a password so big and complex, the site or app starts begging you to stop. At that moment, you can say "ur password system is weak."

  • source
  • parent
  • hideshow 9 child comments
  • [–] 34 points 1 year ago (7 children)

    Careful with that. Sometimes a site will allow you to use some stupid long password when you sign up, but then it turns out that some other version of the site or an app for it on other platforms won't accept a password that long!

  • source
  • parent
  • hideshow 7 child comments
  • [–] 12 points 1 year ago (2 children)

    That's okay, I just want to hear "it's too big"

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (2 children)

    Or alternatively, it allows you to enter a password as long as you like, but on their end it gets truncated.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    My e-mail provider does this. I wanted to change my password to some 64 character long generated string. It accepted, but I could not log in after that. After a few tries, I found the reason and, after another few tries, also the limit at which it gets truncated: 16 characters! God, how I hate them for this...

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Perhaps even worse than this is when the hash allows you to enter what you think is your full password, but as long as the first characters are a match then it will succeed.
    16 characters is probably fine as far as passwords go, but if the site is secretly truncating from 16 down to, say, 7 and still allows you to sign in, you don't even realize that your password isn't nearly as secure as you thought it was.

  • source
  • parent
  • [–] 8 points 1 year ago (4 children)

    Almost, but KeepassDX is better 😎

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 1 year ago (3 children)
  • [–] 4 points 1 year ago (2 children)

    It's not a service you're paying for. It is just a password manager.

    Though tbh, I don't know all of bitwardens spesific details.

    It's at least open source, but can you have your passwords stored anywhere other than their servers? What if the company changes path - can you just use another fork or are you stuck.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 16 points 1 year ago

    Bitwarden is self-hostable and foss, with some unofficial software already out there. Not much opportunity for the company to entrap customers if it went evil.

    IMO, for most people it's best to just send them to register at bitwarden. It's less hassle so they might actually follow through, while being infinitely better than what they were doing before.

  • source
  • parent
  • [–] 2 points 1 year ago* (4 children)
  • Arghh, why is every company thinking, that AI will make them valuable...

    "Let AI retrieve, generate and manage all your credentials"

    Yeah a definite nope, for what reason do I use bitwarden? So that exactly this doesn't happen...

    Anyway vaultwarden is what I'm using, much more performant and self-contained, compatible to bitwarden (but you need to host it, obviously)...

  • source
  • parent
  • [–] 1 point 1 year ago (6 children)

    Or just use the built in password managers in chrome or Firefox. No need to pay for a password manager when they are free on the browsers most people already use

  • source
  • parent
  • hideshow 6 child comments
  • [–] 8 points 1 year ago (2 children)

    No need to pay

    I didn't say anything about paying. It's free in both meanings of the word.

    It's also cross-platform and -browser and better than builtin ones.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    Fair enough but both the chrome and Firefox password managers are cross platform and can be exported and imported supporting the ability to move away from them in the future should you choose. So for a first step from having insecure passwords to a password manager that gives strong passwords for someone who doesnt even want to rema strong password in the first place, they are good steps in the right direction. Don't let perfect be the enemy of good.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Don't let perfect be the enemy of good.

    Funnily enough, I almost said that to the keepass person. But there are some upsides. I've seen people find the separate extension ui easier because it doesn't blend into browser settings.

  • source
  • parent
  • [–] 3 points 1 year ago (2 children)

    I wouldn't recommend that. Bitwarden is free and works on any device, and doesn't tie you to a browser. What if you want to switch browsers someday?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 12 points 1 year ago

    Password security and password manager howto should be an essential part of education. But then again if that happened, schools would probably teach how to use some proprietary cloud-based app with built-in datamining, because lobbying. It would only be a matter of time before everyone would find out the company was storing everyone's passwords in plaintext after they all leaked.

  • source
  • [–] 5 points 1 year ago

    Let me write a fucking passphrase instead of ABCabc123! And let me use fucking ã, ñ, é, ç, etc on my passwords - Microsoft doesn't allow spaces or latin special characters

    Forcing people to use upper case, lower case, number and special character is terrible for them and vastly increases password reuse. Besides, almost no one brute forces anything anymore, it's all rainbow tables and invading the database server

  • source
  • [–] 11 points 1 year ago* (last edited 1 year ago) (4 children)

    Correcthorsebatterystaple (somebody link please)

    Edit: Most places wont allow it due to character requirements and length limits, but it does work and is cryptographically sound.

  • source
  • hideshow 4 child comments
  • [–] 3 points 1 year ago (2 children)

    Yep and then they require you to put special characters, numbers, and capital letters because.... Reasons?

    I would be the one getting hacked, not them.... Let me do what I want.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago

    It's just because of entropy. More entropy is more secure.

    Also sure, it's you getting hacked, but it's the service that got hacked that will have all kinds of news stories written about their weak password requirements.

  • source
  • parent
  • [–] 2 points 1 year ago

    At home I have a notebook, at work I have a system, so I can deduce the password most of the times.

  • source
  • [–] -1 points 1 year ago (1 child)

    Keep a physical, paper password notebook, and write something boring, like "recipes" on the front of it.

  • source
  • hideshow 1 child comment