You remind me of my bank about 17 years ago. Everyone had to have a 10-character password, exactly, and it had to include exactly 2 numbers and 1 symbol. I wasn’t very knowledgeable about computers at the time and it already felt dumb.
Please pick a password starting with ad and ending with min
Submitted 8 months ago by qaz@lemmy.world to mildlyinfuriating@lemmy.world
https://lemmy.world/pictrs/image/70fa0c39-ba80-4c30-9918-7d7187ef927d.png
Comments
Eiri@lemmy.world 8 months ago
Wogi@lemmy.world 8 months ago
A few years ago my ISP pushed an update to my router that changed the password requirements, invalidating my passwords. Because I couldn’t enter the old password I also couldn’t change the password. I had to do a factory reset.
JackbyDev@programming.dev 8 months ago
Feels odd to check the password requirements on the enter password screen in addition to the new password screen.
Eiri@lemmy.world 8 months ago
Wow that’s a big oops
Glitterbomb@lemmy.world 8 months ago
ISP worker here. Our chosen routers default to an 8 digit password, the first 4 are the last 4 of the mac in hex, which anyone can easily see being broadcast by the wifi network. The last 4 are a part of a unique serial number, but its just 0-9. Ultimately, if you try to brute force this default password, you need 10000 tries. It takes a regular GPU 2 minutes with hashcat. It baffles my mind that companies think this is OK.
ByteOnBikes@slrpnk.net 8 months ago
17 years ago, jeez. My credit Union’s website is like that. Only its between 8-12 characters. No more, no less.
It’s terrifying.
RecluseRamble@lemmy.dbzer0.com 8 months ago
At that time my bank allowed up to 6 digits as a password. I kid you not, like a card PIN but for online banking login. I believe the whole banking security relies on their backoffices still running on paper.
Eiri@lemmy.world 8 months ago
That’s what my current bank uses for the web portal now to think of it. Client number, and 6-number PIN. I guess they’re only doing this because they really trust their “unusual activity” protocols, but I’ve got a feeling they really shouldn’t only rely on those.
9point6@lemmy.world 8 months ago
underlines
gratux@lemmy.blahaj.zone 8 months ago
german programmers trying to translate Unterstrich
humorlessrepost@lemmy.world 8 months ago
My unterstrich is chafed.
dohpaz42@lemmy.world 8 months ago
/^\w{6,16}$/yamanii@lemmy.world 8 months ago
Those cases where an english word gets absorbed even though no one from the origin talks like that. It’s also informally called underline here lol.
guy_threepwood@lemmy.world 8 months ago
I had one of those “fancy” Vodafone routers included with my broadband which had a stupid rule set on choosing the WiFi password. It’s my network, not yours, stupid router. It can be as insecure as I want.
Anyway the rules were enforced by the JavaScript so it was easy to bypass until I got my own router to replace it with.
infeeeee@lemm.ee 8 months ago
It’s important to note, that these things are designed for the average user. If you want to change the wifi password, you are by far not an average user. Most users just plugs in and never even think about that, and the number of that kind of users are several order of magnitude higher than the conscious ones. For them it’s much more secure to set a random pw. If you let them select a password they will choose
12345orpassword.If you know what you are doing usually it’s better to buy your own router where you can change everything the way you like.
JackbyDev@programming.dev 8 months ago
If we could magically get the data I’d be willing to bet at least half of everyone thinks they can’t change their router password.
Machefi@lemm.ee 8 months ago
Assuming we can use both lower- and uppercase letters (52 in total), with the ten digits and the underscore that gives us 63 characters to work with. A random 16-character combination of these gives us 95 bits of entropy (rounding down), which is secure enough by modern standards, at least for a home router.
Regardless, I understand the frustration of arbitrary limitations preventing you from choosing a secure password in a way that you’re comfortable with.
possiblylinux127@lemmy.zip 8 months ago
Create a randomly generated password and store it in a password manager
peter@lemmy.emerald.show 8 months ago
I hate that kind of stuff, when I see this I wonder if they hash the password at all
rekabis@lemmy.ca 8 months ago
16 characters was the minimum length a password should be due to how easy it was to crack… something like ten years ago.
Now it’s something like 20 to 24 characters.
Seriously, if your company is defining maximum password length and demanding specific content, it is failing at the security game. Have the storage location accept a UTF-8 string of at least 2048 bytes - or
nvarchar(max)if it’s a database field - and do a bitwise complexity calculation as your only “minimum value” requirement.Look at how KeePass calculates password complexity, and replicate that for whatever interface you are using. Ensure that it is reasonable, such as 150-200bit complexity, and let users choose whatever they want to achieve that complexity.
Jyek@sh.itjust.works 8 months ago
It’s TPLink. Budget networking equipment comes with budget security principles.
Carighan@lemmy.world 8 months ago
Just do the Password Game to figure out a good one!
Blaster_M@lemmy.world 8 months ago
TP-Link… TP-Link…
I don’t trust your bottom barrel software, TP-Link…
const_void@lemmy.ml 8 months ago
Lol. Imagine thinking TP Link takes security seriously.
doggle@lemmy.dbzer0.com 8 months ago
admin wouldn’t even work. It’s too short.
Agret@lemmy.world 8 months ago
Username admin
Password passwordAs is tradition
Blisterexe@lemmy.zip 8 months ago
Like my router that defaulted to
Root
Root
mxcory@lemmy.blahaj.zone 8 months ago
“adimin”
bjoern_tantau@swg-empire.de 8 months ago
Take a string as bytes is bad with weird non-ASCII characters. Been there, been bitten in the ass by it.
At least with e-mail clients different clients on different operating systems use different encoding by default for their passwords.
With a router I could imagine different client apps following different standards.
expr@programming.dev 8 months ago
You don’t have to take arbitrary bytes. UTF-8 encoded strings are just fine and easily handled by libraries.
bjoern_tantau@swg-empire.de 8 months ago
At least with e-mail clients different clients on different operating systems use different encoding by default for their passwords.
Mwa@thelemmy.club 8 months ago
I HATE THIS SOO MUCH AHHHHH
superkret@feddit.org 8 months ago
add1more_Dopamin
abfarid@startrek.website 8 months ago
Adrenamin™
UpperBroccoli@lemmy.blahaj.zone 8 months ago
English letters? Really? So basically no a-z, only Æ, Þ, Ƿ, Ð?
ImplyingImplications@lemmy.ca 8 months ago
Ye olde passwarde
fartsparkles@sh.itjust.works 8 months ago
What have the Romans ever done for us?
Spot@startrek.website 8 months ago
Roads?
egrets@lemmy.world 8 months ago
Also Œ, Ȝ, and arguably W and U.
drolex@sopuli.xyz 8 months ago
Anglo-saxons got the UWU, nice
Carighan@lemmy.world 8 months ago
Would ë qualify?
jwt@programming.dev 8 months ago
U_w0t_M8