It's also a gigantic red flag when sites say there's a password limit

Bitch, my password is supposed to be hashed so even if I uploaded the LOTR trilogy extended edition in 4K, it should still come out the same length as any other SHA256 hash

In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.

With that being said, “In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.” is an even stronger password.

Nothing infuriates me more than when they ask me to reduce my 20 char alphanumeric+symbols unique password to a 4 char numeric pin for my security.

Your password must be at least 10 characters long.

ERROR: INVALID PASSWORD ENTERED!!!

PASSWORD MUST NOT EXCEED 12 CHARACTERS!

correct horse battery staple

Requiring specific characters reduces the number of permutations. The only thing that makes a password more secure is increasing the minimum length. As the OP suggests, enforcing special characters makes most people just put a special character at the end. What you have effectively done is make the last character so easy to guess that it might as well not exist.

And don't you dare use stuff like , or ç as a special character!

for real, why is it so hard to count entropy?

I have 5-6 apps I log into for work that all have different password requirements and are on different expiration periods. One of them is so crazy that I have to take 3-4 spins on a password generator before I get one it will accept. We also don't have a password manager that's approved to install. So, the result of all this is that I store my passwords in onenote. Very secure. Great job everyone. At least for the less severe ones I can just put whatever number I'm tagging on the end of the usual password I use.

My new job has us doing various security trainings every month and they also send out fake phishing emails. I initially ignored the emails prompting me to do the training because they require you to click a personalized link in the email to access the training. Eventually, my manager reached out and asked why I hadn't done the training, so I explained, but finally clicked through to do it. That month's training was about how a long passphrase is more secure than a list of character type requirements. Guess whose password requirements are a list of character type requirements?

Fun fact: As an anti-scam measure, if you type your password in a comment, Lemmy will automatically censor it for you.

Like this:

************

Cool, right?

The new recommendation is 30 character or more passphrases with some noise.

The FBI training I’m forced to take at work suggests replacing characters in that manner. “Just use a $ instead of S!”

But back in like 2006 I brute forced a dump of 20 Windows passwords in that style on my old Dell single core machine in less than two seconds. Every passing year I’m still shocked people continue thinking this would work.

My last job was at AutoZone and our password requirements were stricter and had to be changed twice as often as my password on our secured computer when I was in the Navy.

Lemmy devs still haven't figured this out.

Do you want your password to be sent raw into a service to analyze your password entropy and detect common patterns, OR do you want a simple rule which can be checked client side?

I still stand by xkcd 936.

Since no one can know which characters you used, you have to assume all/most. Throw one character in there to be safe, in the middle of a word.

Banks on the other hand: no you're only allowed 4 numbers!

I assumed it was password1! Yours is better

Let me introduce you to MyP4s$worcl*websitename**@