Czech your passwords.

[benroyce@mastodon.social]

@evdelen @jupiter

"What you have installed

Your system has 22 text-to-speech voices installed, the exact set is a strong fingerprint.how?

You have Japanese language pack support installed.how?

You have Chinese language pack support installed.how?

You have South Asian script language pack support installed.how?

You have programmer fonts installed, you write code.how?"

fuck

[kasperd@westergaard.social]

I am happy to announce that I just tested those passwords in the password strength evaluation that I wrote for Intempus. And both of them fail due to repetitions. Using ř scores slightly higher, but only because there is also r in my username.

[kalvaro@mastodon.social]

@falken In some Android keyboards it's ridiculously hard to type a $ character. Don't ask me how I noticed.

[kasperd@westergaard.social]

Nah, yours is three characters shorter. So I rate the previous one as a bit more secure. But both are rated pretty high by my calculations.

[dryak@mstdn.science]

@benroyce @jupiter

In all seriousness this is a genuine problem (due to UTF-8 normalization-- composition vs decomposition) if you switch between MacOS (always use ASCII latin letter codepoint + diacritic codepoint, no matter what; i.e. "o" + "/", "r" + carron, etc.) and anything else (always prefere one single codepoint if the accented letter exists, e.g., in the Latin-1 block: "ø", Latin Extended-A block: "ř")
...

[dryak@mstdn.science]

@benroyce @jupiter ...

See an old post of mine on Unix stackexchange:
https://unix.stackexchange.com/questions/494883/utf8-character-makes-file-inaccessible/494909#494909

[benroyce@mastodon.social]

@dryak @jupiter

well way to ruin my stupid joke!

just kidding

it is a serious issue

[isukun@tkz.one]

@jupiter

Ja ja ja ja ja ja ja ja ja ja XD

[kasperd@westergaard.social]

I totally agree with that. There was a time where I used machines with both Danish and American keyboard layouts on a daily basis. So I learned to pick passwords consisting of only characters that were located in the same place on both keyboards.

And that was a time when only ASCII was supported, so I had to keep that in mind as well.

The best way to make passwords stronger is to make them longer rather than using more different characters.

I am so annoyed by sites that get this wrong. First they reject my 32 character password because it’s too long. So I try truncating my password to 12, 16, or 20 characters (whatever they permit), and then they reject it because I only have alphanumeric characters. Seriously, the password I started with was stronger than such a short password could ever be. So the weakness of the password I am trying is entirely caused by their low limit on password length and not by the set of characters I had chosen to use.

A user should be allowed to use a password consisting of only two distinct characters as long as it’s long enough and doesn’t have any patterns.

[modernmaslow@techhub.social]

@jupiter Clearly you rrrrrrr inverting the dunce cap...

[kasperd@westergaard.social]

Surprisingly that password is not found in https://haveibeenpwned.com/Passwords, are you sure there are actually Germans using that?

[w00p@infosec.exchange]

@jupiter the impossible-to-pronounce-for-a-non-Czech password

[cy@chaos.social]

@kasperd @jupiter i like my passwords like my potatoes! heavily salted

[beyoublahaj@mastodon.social]

@jupiter Going for extra Polish is also a valid strategy.

[greynerd65@mastodon.social]

@evdelen @benroyce @jupiter
I’ve done this test before, using the same device, and this programme did NOT recognise me – or rather, my device.
All the details about my device were wrong again: two matches – namely ‘Windows’ (which almost every device has; I would at least have expected the version to be specified) and ‘x86’ (which is also standard, but the RAM was listed incorrectly too).
So it seems my settings are correct.

[benroyce@mastodon.social]

@greynerd65 @evdelen @jupiter

"directorate of analysis, make a note on this file: greynerd65 fell for the social hack of leaking opsec details by luring them into a false sense of informality"

[kasperd@westergaard.social]

Interestingly the lower case version of that password is found in exactly one leak known to https://haveibeenpwned.com/Passwords

[kasperd@westergaard.social]

The pronunciation point got me wondering whether an American would be able to pronounce this password: zzzccccczczczcczczcc

[jan@social.janantos.com]

@dryak @benroyce @jupiter few years ago my ETL to analytics cube start suddenly failing because of company enabled registration via mobile app and one user decided to have username as “Princess” yeah I know I wasn’t sanitizing input enough, but tbh no one expected this when the ETL was designed.

[kasperd@westergaard.social]

For sure, leaving out the salt is highly irresponsible.

But I don’t trust sites to be salting, so I pick passwords that are strong enough that even if a site stored it using a single iteration of MD5 with no salting it would not be broken.