Czech your passwords.
-
"What you have installed
Your system has 22 text-to-speech voices installed, the exact set is a strong fingerprint.how?
You have Japanese language pack support installed.how?
You have Chinese language pack support installed.how?
You have South Asian script language pack support installed.how?
You have programmer fonts installed, you write code.how?"
fuck
@benroyce@mastodon.social @evdelen@mstdn.ca @jupiter@mastodon.gamedev.place you probably have noto fonts <img class=“not-responsive emoji” src=“https://outerheaven.club/emoji/neofox/neofox_lul_256.png” title=“:neofox_lul:” />
-
@kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter keep two different keyboards on your desk?
@falken @kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter actually no.
LUKSsaves #Keycodes, not actual letters & Symbols!- Try it!
-
@mkyral @TheKeystoneCollective @jupiter Password must contain special characters, numerals and at least one vowel.
@goedelchen @mkyral @TheKeystoneCollective @jupiter Croatia left the chat
-
Czech your passwords.
@jupiter why does this remind me of some shitty track?
-
@jupiter Which website is this? That's weird! zxcvbn measures both passwords as weak and old-style (aka bad) password strength meters overestimate mixing character classes (so repeating a single character wouldn't work).
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?
-
Czech your passwords.
@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.
Example:řřřřřřřřřandřřřřřřřřřmight seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)
Compare plain pre-combinedřas U+XXXX and ASCIIrwith a combining caron coded as U+0072 then U+030c. These should render the same. -
@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.
Example:řřřřřřřřřandřřřřřřřřřmight seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)
Compare plain pre-combinedřas U+XXXX and ASCIIrwith a combining caron coded as U+0072 then U+030c. These should render the same.@jupiter@mastodon.gamedev.place
Copied and pasted from the post, you can tell they are different in the hexdump.
Fun fact: When pasted into a Vim, searching forřřřřřřřřřhighlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!řřřřřřřřř and řřřřřřřřř 00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc r..........r..r. 00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599 .r..r.. and .... 00000020: c599 c599 c599 c599 c599 c599 c599 0a ............... -
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?
@diffie @jupiter
Depends on the implementation!One: implementations can use Unicode normalisation so it always handles them combined or always separated.
Two: zxcvbn detects repetition (and penalises it) even strings of two or more repeated substrings!
Three: for character classes-based algorithms, those are weird! IMHO in most cases those are based on "let me guess what a good password is because management asked for a password strength meter" and thus you have lots of implementations based on regex, but also ranges of ASCII ranges and all sorts of mess code. I wonder if AI still generates this messy code or if they just recommend a properly tested library like zxcvbn. I guess the first.
-
@jupiter@mastodon.gamedev.place
Copied and pasted from the post, you can tell they are different in the hexdump.
Fun fact: When pasted into a Vim, searching forřřřřřřřřřhighlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!řřřřřřřřř and řřřřřřřřř 00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc r..........r..r. 00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599 .r..r.. and .... 00000020: c599 c599 c599 c599 c599 c599 c599 0a ...............@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website. -
@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website.@Override @jupiter@mastodon.gamedev.place … or over-normalize the text.
I noticed that Discord converts my U+00a0 NBSPs to U+0020 plain spaces. -
@diffie @jupiter
Depends on the implementation!One: implementations can use Unicode normalisation so it always handles them combined or always separated.
Two: zxcvbn detects repetition (and penalises it) even strings of two or more repeated substrings!
Three: for character classes-based algorithms, those are weird! IMHO in most cases those are based on "let me guess what a good password is because management asked for a password strength meter" and thus you have lots of implementations based on regex, but also ranges of ASCII ranges and all sorts of mess code. I wonder if AI still generates this messy code or if they just recommend a properly tested library like zxcvbn. I guess the first.
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place I've seen even a password meter which was totally fine with 10s of
as and it said it's a strong password, so… yes.
-
-
@chemlon
Třista třicet tři stříbrných stříkaček stříkalo přes třista třicet tři stříbrných střech. -
Czech your passwords.
@jupiter Hope to never have to login at another keyboard in the world!
or keep the Unicode at hand 
-
Czech your passwords.
En France c'est ééééééééé
-
S simonjust@mstdn.dk shared this topic
