Just take the string as bytes and hash it ffs
You remind me of my bank about 17 years ago. Everyone had to have a 10-character password, exactly, and it had to include exactly 2 numbers and 1 symbol. I wasn’t very knowledgeable about computers at the time and it already felt dumb.
At that time my bank allowed up to 6 digits as a password. I kid you not, like a card PIN but for online banking login. I believe the whole banking security relies on their backoffices still running on paper.
That’s what my current bank uses for the web portal now to think of it. Client number, and 6-number PIN. I guess they’re only doing this because they really trust their “unusual activity” protocols, but I’ve got a feeling they really shouldn’t only rely on those.
17 years ago, jeez. My credit Union’s website is like that. Only its between 8-12 characters. No more, no less.
It’s terrifying.
A few years ago my ISP pushed an update to my router that changed the password requirements, invalidating my passwords. Because I couldn’t enter the old password I also couldn’t change the password. I had to do a factory reset.
Wow that’s a big oops
Feels odd to check the password requirements on the enter password screen in addition to the new password screen.
Might be checking the old password on the new password screen. Easy programming mistake to make I guess? Apply the same validation to all 3 password fields…
Ahhh, good catch! You are probably a master of code reviews and QA!
ISP worker here. Our chosen routers default to an 8 digit password, the first 4 are the last 4 of the mac in hex, which anyone can easily see being broadcast by the wifi network. The last 4 are a part of a unique serial number, but its just 0-9. Ultimately, if you try to brute force this default password, you need 10000 tries. It takes a regular GPU 2 minutes with hashcat. It baffles my mind that companies think this is OK.
deleted by creator
TP-Link… TP-Link…
I don’t trust your bottom barrel software, TP-Link…
deleted by creator
Create a randomly generated password and store it in a password manager
It’s because of shit like this, I’ve had a document containing all passwords and accounts stashed away.
I’m going to copy and paste, fuck anyone thinking I’m going to manually enter their shit.
Why not just use password manager?
not as portable
Yeah, I’m with you on that. Everyone on Lemmy loves password managers, but I don’t really like the idea of entrusting all of my passwords for everything with one singular program. I actually also dislike 2 factor authentication. One time my phone broke and my bank wanted to verify my identity to purchase a new phone. Except my phone was broken so I couldn’t… Yeah I really don’t want to run into that scenario again except worse.
I’ve actually gone old school with it and I keep most passwords physically written down in a notebook using my own cypher language/pictograms. If someone irl really wants to break into my home, find the notebook, and try to decode it, I’d be in bigger trouble to begin with. It’s very unlikely.
2 factor when done right is nice, however phones should Never be a requirement for anything and 2fa should require at least two physical keys before being allowed to be enabled.
I ran into the same issue, I didn’t want to use a cloud password manager because entrusting literally every password I have to a third party and on the internet sounds absurd to me. KeePass seemed like a good idea for me, but at the time I fell back to syncing the vault by sending it to myself in Telegram any time I made a change. Certainly not ideal
I now just have an RPi self hosting Vaultwarden with Tailscale, and for me that’s been the best solution that keeps me happy; it’s more secure as someone needs to compromise my Tailnet first, it’s not public facing, I’m not trusting a third party to not lose my vault (a la LastPass), but its still convenient.
Keepass and syncthing are great combined. Functions fully locally even when I have no access to my home network, and changes get synced between my desktop, laptop, and phone whenever I have WAN access.
Yeah, I probably would have gone with that solution if I knew about it at the time, but now that I have Vaultwarden I’m pretty happy with it.
How do you handle (and test) backups?
I’m gonna be honest, for Vaultwarden I don’t. However, a local cached copy of the vault exists on all my devices that are signed in via the official Bitwarden client, and I have recovered using this method before, so that’s my backup strategy.
I use a keepass vault thrown in a syncthing directory but like literally any file sync will do. If you get conflicts, KeePassXC can merge them
underlines
Those cases where an english word gets absorbed even though no one from the origin talks like that. It’s also informally called underline here in Brazil lol.
german programmers trying to translate Unterstrich
My unterstrich is chafed.
/^\w{6,16}$/
Take a string as bytes is bad with weird non-ASCII characters. Been there, been bitten in the ass by it.
At least with e-mail clients different clients on different operating systems use different encoding by default for their passwords.
With a router I could imagine different client apps following different standards.
You don’t have to take arbitrary bytes. UTF-8 encoded strings are just fine and easily handled by libraries.
At least with e-mail clients different clients on different operating systems use different encoding by default for their passwords.
The manufacturer obviously also makes the app and can control the encoding.
With a router I could imagine different client apps following different standards.
Many routers can also be controlled via Telnet, which will also use different encodings depending on your OS.
Y’all use UTF8? laughs in Japanese websites
/ can we please stop EUC-JP and SJIS and MS932 and all just switch to UTF8, please, Japan?!
Just do the Password Game to figure out a good one!
I hate that kind of stuff, when I see this I wonder if they hash the password at all
deleted by creator
16 characters was the minimum length a password should be due to how easy it was to crack… something like a decade ago.
Now it’s something like 20 to 24 characters.
Seriously, if your company is defining maximum password length and demanding specific content, it is failing at the security game. Have the storage location accept a hashed UTF-8 string of at least 4096 bytes - or
nvarchar(max)if it’s a database field - and do a bitwise complexity calculation on the raw password as your only “minimum value” requirement.Look at how KeePass calculates password complexity, and replicate that for whatever interface you are using. Ensure that it is reasonable, such as 150-200bit complexity, and let users choose whatever they want to achieve that complexity.
It’s TPLink. Budget networking equipment comes with budget security principles.
Lol. Imagine thinking TP Link takes security seriously.
I HATE THIS SOO MUCH AHHHHH
add1more_Dopamin
admin wouldn’t even work. It’s too short.
Username admin
Password passwordAs is tradition
Like my router that defaulted to
Root
Root
One of mine defaulted to root with no password set.
“adimin”
Adrenamin™
