Czech your passwords.

[hrw@society.oftrolls.com]

@jupiter @makdaam

Polish your password:

"aaaaaaaaaa" -> "ąąąąąąąąąą"

[chewie@mammut.gogreenit.net]

@cy @jupiter There's quite a good video about password cracking fro #Steelcon 2025 here: https://www.youtube.com/watch?v=fLGpfrWCQMc

[sadth@mastodon.world]

@mkyral @TheKeystoneCollective @jupiter StrčTřiPrstySkrz1Krk while we're doing numbers?

[goedelchen@mastodontech.de]

@mkyral @TheKeystoneCollective @jupiter Password must contain special characters, numerals and at least one vowel.

[nobody@mastodon.acm.org]

@jupiter

Czechia strong!

[benroyce@mastodon.social]

@jupiter

Enter password

RødgrødMedFløde

Enter password

RødgrødMedFløde

Enter password

That is my password!

There's something off about how you type the password. Access denied

[jan@social.janantos.com]

@jupiter žluťoulinkatý kůň

[lynxbaal@ohai.social]

@jupiter ĹĹĹĹĹĹĹĹĹ

[qgustavor@urusai.social]

@jupiter Which website is this? That's weird! zxcvbn measures both passwords as weak and old-style (aka bad) password strength meters overestimate mixing character classes (so repeating a single character wouldn't work).

[nobrainnopain@social.tchncs.de]

@falken @kajer @MegaMichelle @jupiter @CrackMeIfYouCan about 15 years ago, I set up an Apple TimeCapsule for my wife. Guess what happened: The password chosen to connect didn’t work - and hours later I found out why: There was an umlaut, ä, in her password. Replaced the umlaut by ae - and everything was fine…

[evdelen@mstdn.ca]

@benroyce @jupiter

https://kuber.studio/cookie/

Follow this one past the typing test... Not that far off from the truth.

[benroyce@mastodon.social]

@evdelen @jupiter

"What you have installed

Your system has 22 text-to-speech voices installed, the exact set is a strong fingerprint.how?

You have Japanese language pack support installed.how?

You have Chinese language pack support installed.how?

You have South Asian script language pack support installed.how?

You have programmer fonts installed, you write code.how?"

fuck

[kasperd@westergaard.social]

I am happy to announce that I just tested those passwords in the password strength evaluation that I wrote for Intempus. And both of them fail due to repetitions. Using ř scores slightly higher, but only because there is also r in my username.

[kalvaro@mastodon.social]

@falken In some Android keyboards it's ridiculously hard to type a $ character. Don't ask me how I noticed.

[kasperd@westergaard.social]

Nah, yours is three characters shorter. So I rate the previous one as a bit more secure. But both are rated pretty high by my calculations.

[dryak@mstdn.science]

@benroyce @jupiter

In all seriousness this is a genuine problem (due to UTF-8 normalization-- composition vs decomposition) if you switch between MacOS (always use ASCII latin letter codepoint + diacritic codepoint, no matter what; i.e. "o" + "/", "r" + carron, etc.) and anything else (always prefere one single codepoint if the accented letter exists, e.g., in the Latin-1 block: "ø", Latin Extended-A block: "ř")
...

[dryak@mstdn.science]

@benroyce @jupiter ...

See an old post of mine on Unix stackexchange:
https://unix.stackexchange.com/questions/494883/utf8-character-makes-file-inaccessible/494909#494909

[benroyce@mastodon.social]

@dryak @jupiter

well way to ruin my stupid joke!

just kidding

it is a serious issue

[isukun@tkz.one]

@jupiter

Ja ja ja ja ja ja ja ja ja ja XD

[kasperd@westergaard.social]

I totally agree with that. There was a time where I used machines with both Danish and American keyboard layouts on a daily basis. So I learned to pick passwords consisting of only characters that were located in the same place on both keyboards.

And that was a time when only ASCII was supported, so I had to keep that in mind as well.

The best way to make passwords stronger is to make them longer rather than using more different characters.

I am so annoyed by sites that get this wrong. First they reject my 32 character password because it’s too long. So I try truncating my password to 12, 16, or 20 characters (whatever they permit), and then they reject it because I only have alphanumeric characters. Seriously, the password I started with was stronger than such a short password could ever be. So the weakness of the password I am trying is entirely caused by their low limit on password length and not by the set of characters I had chosen to use.

A user should be allowed to use a password consisting of only two distinct characters as long as it’s long enough and doesn’t have any patterns.