Nothing infuriates me more than when they ask me to reduce my 20 char alphanumeric+symbols unique password to a 4 char numeric pin for my security.
*Proceeds to append an exclamation mark*
Submitted 2 weeks ago by user224@lemmy.sdf.org to [deleted]
https://i.imgflip.com/b2rr6x.jpg
Comments
stopforgettingit@lemmy.world 2 weeks ago
Aeder@lemmy.world 2 weeks ago
My (soon to be ex) bank recently decided to make everyone use their ID card number which can be obtained from many sources and does not change, a username with symbols and numbers and minimal length requirements which cannot be changed and a 4 digit pin code. No 2FA at all, so its only saving grace is that you get locked out at 3 tries.
I’m guessing they are trying to align everything to their legacy ATM pin code system instead of making the ATM system better.
Warl0k3@lemmy.world 2 weeks ago
Credit unions really are refreshing (as much as a financial institution can be, at least). Mine’s utter shit, but they’ve still gone to unrestricted length ATM pins and options for 2FA / 3FA online access and they support FIDO2 for auth & transaction confirmation. It’s ridiculous how behind the establishment banks are getting.
JoeBigelow@lemmy.ca 2 weeks ago
There is something about ATM system architecture that must be so ancient it ran on punch cards. In reality I’m sure it’s COBOL being COBOL but there’s hardly any excuse for a machine to take SO LONG to process a simple transaction.
gastroglizzy@piefed.social 2 weeks ago
Fun fact: As an anti-scam measure, if you type your password in a comment, Lemmy will automatically censor it for you.
Like this:
************
Cool, right?
DaveyRocket@lemmy.world 2 weeks ago
How does mine look?
Hunter2
deadbeef79000@lemmy.nz 2 weeks ago
I just see *'s.
joyjoy@piefed.social 2 weeks ago
This is just a css trick. Your full password text is still there in the html.
veni_vedi_veni@lemmy.world 2 weeks ago
Really the same weak ass jokes from reddit huh?
JayDee@lemmy.world 2 weeks ago
Calm down, Satan.
PrettyFlyForAFatGuy@feddit.uk 2 weeks ago
11 year old me fell for this on runescape
nullify3112@lemmy.world 2 weeks ago
Covfefe
nullspace@lemmy.world 2 weeks ago
Your password must be at least 10 characters long.
ERROR: INVALID PASSWORD ENTERED!!!
PASSWORD MUST NOT EXCEED 12 CHARACTERS!
helpImTrappedOnline@lemmy.world 2 weeks ago
Even better when it doesn’t tell you and just drops the last characters.
shirasho@feddit.online 2 weeks ago
Requiring specific characters reduces the number of permutations. The only thing that makes a password more secure is increasing the minimum length. As the OP suggests, enforcing special characters makes most people just put a special character at the end. What you have effectively done is make the last character so easy to guess that it might as well not exist.
shrugs@piefed.social 2 weeks ago
for real, why is it so hard to count entropy?
Ertain@feddit.online 2 weeks ago
I guess it’s too chaotic.
ICastFist@programming.dev 2 weeks ago
And don’t you dare use stuff like
,orças a special character!QualifiedKitten@discuss.online 2 weeks ago
My new job has us doing various security trainings every month and they also send out fake phishing emails. I initially ignored the emails prompting me to do the training because they require you to click a personalized link in the email to access the training. Eventually, my manager reached out and asked why I hadn’t done the training, so I explained, but finally clicked through to do it. That month’s training was about how a long passphrase is more secure than a list of character type requirements. Guess whose password requirements are a list of character type requirements?
lightnsfw@reddthat.com 2 weeks ago
I have 5-6 apps I log into for work that all have different password requirements and are on different expiration periods. One of them is so crazy that I have to take 3-4 spins on a password generator before I get one it will accept. We also don’t have a password manager that’s approved to install. So, the result of all this is that I store my passwords in onenote. Very secure. Great job everyone. At least for the less severe ones I can just put whatever number I’m tagging on the end of the usual password I use.
chiliedogg@lemmy.world 2 weeks ago
We had a system at one of my old companies that with each password change, you couldn’t have any of the same characters that were in your last password (12 character max so it was never impossible to solve), you couldn’t have the same character in the same place as any of your last 10 passwords, or the same character type (letter or number) in the same space as the last password. Also no special characters.
The end result was everyone ended up using a1a1a1a1 for the first password, then 2b2b2b2b, c3c3c3c3, 4d4d4d4d, etc. The draconian password requirements resulted in everyone using the same passwords.
lightnsfw@reddthat.com 2 weeks ago
You know some turd in the IT department was so proud of themselves for coming up with that too.
Hansae@lemmy.dbzer0.com 2 weeks ago
At work my main password has to be changed every two weeks and has insane requirements and we can only use some shit company approved password manager which I cant even install on a rooted phone. This has resulted me in just changing 1 digit every 2 weeks, 10/10 guys!
chiliedogg@lemmy.world 2 weeks ago
I have to do it every 3 months. I’m at [password]27! now.
undefined@lemmy.hogru.ch 2 weeks ago
The FBI training I’m forced to take at work suggests replacing characters in that manner. “Just use a $ instead of S!”
But back in like 2006 I brute forced a dump of 20 Windows passwords in that style on my old Dell single core machine in less than two seconds, and every time I’m shocked people still think this is secure.
JustPlainDave@lemmy.zip 2 weeks ago
My last job was at AutoZone and our password requirements were stricter and had to be changed twice as often as my password on our secured computer when I was in the Navy.
LogicalDrivel@sopuli.xyz 2 weeks ago
You never know when them O’reily boys will try and hack you. You gotta be prepared!
Toes@ani.social 2 weeks ago
The new recommendation is 30 character or more passphrases with some noise.
nullify3112@lemmy.world 2 weeks ago
Let me introduce you to MyP4s$worcl*websitename**@
tatterdemalion@programming.dev 2 weeks ago
Lemmy devs still haven’t figured this out.
Strider@lemmy.world 2 weeks ago
lemmygarden@lemmy.today 2 weeks ago
I assumed it was password1! Yours is better
Monument@piefed.world 2 weeks ago
In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.
With that being said, “In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.” is an even stronger password.
taiyang@lemmy.world 2 weeks ago
I love systems that accept “With that being said, “In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.” is an even stronger password.” as my password.
otacon239@lemmy.world 2 weeks ago
For those that have full Unicode support, including newline characters and a very high or nonexistent character limit, using:
as your password is an even stronger password.
imetators@lemmy.dbzer0.com 2 weeks ago
Thus reads like xkcd
Monument@piefed.world 2 weeks ago
That is a wonderful compliment. Thank you.