Czech your passwords.

[madness832@mstdn.party]

@jupiter Rrrrrrrrr me hardies!

[the_error@witter.cz]

@sadth @mkyral @TheKeystoneCollective @jupiter třistatřicettřistříbrnýchstříkačekstříkalopřes333střech

[xarvos@outerheaven.club]

@benroyce@mastodon.social @evdelen@mstdn.ca @jupiter@mastodon.gamedev.place you probably have noto fonts <img class=“not-responsive emoji” src=“https://outerheaven.club/emoji/neofox/neofox_lul_256.png” title=“:neofox_lul:” />

[netzblockierer@tech.lgbt]

@falken @kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter actually no.

LUKS saves #Keycodes, not actual letters & Symbols!

• Try it!

[netzblockierer@tech.lgbt]

@goedelchen @mkyral @TheKeystoneCollective @jupiter Croatia left the chat

#sarcasm #shitpost

[kkarhan@mastodon.social]

@jupiter why does this remind me of some shitty track?

[diffie@mk.absturztau.be]

@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?

[diffie@mk.absturztau.be]

@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.

Example: řřřřřřřřř and řřřřřřřřř might seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)

Compare plain pre-combined ř as U+XXXX and ASCII r with a combining caron coded as U+0072 then U+030c. These should render the same.

[diffie@mk.absturztau.be]

@jupiter@mastodon.gamedev.place

Copied and pasted from the post, you can tell they are different in the hexdump.

Fun fact: When pasted into a Vim, searching for řřřřřřřřř highlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!

řřřřřřřřř and řřřřřřřřř
00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc  r..........r..r.
00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599  .r..r.. and ....
00000020: c599 c599 c599 c599 c599 c599 c599 0a    ...............

[qgustavor@urusai.social]

@diffie @jupiter
Depends on the implementation!

One: implementations can use Unicode normalisation so it always handles them combined or always separated.

Two: zxcvbn detects repetition (and penalises it) even strings of two or more repeated substrings!

Three: for character classes-based algorithms, those are weird! IMHO in most cases those are based on "let me guess what a good password is because management asked for a password strength meter" and thus you have lots of implementations based on regex, but also ranges of ASCII ranges and all sorts of mess code. I wonder if AI still generates this messy code or if they just recommend a properly tested library like zxcvbn. I guess the first.

[override@mk.absturztau.be]

@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website.

[diffie@mk.absturztau.be]

@Override @jupiter@mastodon.gamedev.place … or over-normalize the text. ​​ I noticed that Discord converts my U+00a0 NBSPs to U+0020 plain spaces.

[diffie@mk.absturztau.be]

@qgustavor@urusai.social @jupiter@mastodon.gamedev.place I've seen even a password meter which was totally fine with 10s of as and it said it's a strong password, so… yes. ​​

[alesroubicek@indieweb.social]

@zl2tod @jupiter Ahoj!

[alesroubicek@indieweb.social]

@jupiter @chemlon Řehoři, tetřev! Tř Tř

[luc0x61@mastodon.gamedev.place]

@jupiter Hope to never have to login at another keyboard in the world! or keep the Unicode at hand

[keinebasisfuerpalantir@rheinneckar.social]

@jupiter

En France c'est ééééééééé