Czech your passwords.
-
I totally agree with that. There was a time where I used machines with both Danish and American keyboard layouts on a daily basis. So I learned to pick passwords consisting of only characters that were located in the same place on both keyboards.
And that was a time when only ASCII was supported, so I had to keep that in mind as well.
The best way to make passwords stronger is to make them longer rather than using more different characters.
I am so annoyed by sites that get this wrong. First they reject my 32 character password because it’s too long. So I try truncating my password to 12, 16, or 20 characters (whatever they permit), and then they reject it because I only have alphanumeric characters. Seriously, the password I started with was stronger than such a short password could ever be. So the weakness of the password I am trying is entirely caused by their low limit on password length and not by the set of characters I had chosen to use.
A user should be allowed to use a password consisting of only two distinct characters as long as it’s long enough and doesn’t have any patterns.
@kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter at one point Linux boot-time FS decrypt wouldn't use the O/S locale, but en-US, so here in en-GB things like @ in pass phrases were... Interesting...
-
@kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter at one point Linux boot-time FS decrypt wouldn't use the O/S locale, but en-US, so here in en-GB things like @ in pass phrases were... Interesting...
Imagine how the German and the French would deal with that.
-
Imagine how the German and the French would deal with that.
@kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter keep two different keyboards on your desk?
-
Czech your passwords.
-
Czech your passwords.
@jupiter And doucle-Czech your password checker?
-
Czech your passwords.
-
F folfdk@helvede.net shared this topic
-
Czech your passwords.
what a great idea!
-
"Special characters"
@MegaMichelle @jupiter mind you, even a single special character like the romanian "ă" especially raises entropy by a lot, firstly because it's an unique character only used in romanian and secondly because it is technically outside of the standard Latin alphabet
anyway, we all love spêciăl châracțerș. -
Czech your passwords.
@jupiter Rrrrrrrrr me hardies!
-
@mkyral @TheKeystoneCollective @jupiter StrčTřiPrstySkrz1Krk while we're doing numbers?
@sadth @mkyral @TheKeystoneCollective @jupiter třistatřicettřistříbrnýchstříkačekstříkalopřes333střech
-
"What you have installed
Your system has 22 text-to-speech voices installed, the exact set is a strong fingerprint.how?
You have Japanese language pack support installed.how?
You have Chinese language pack support installed.how?
You have South Asian script language pack support installed.how?
You have programmer fonts installed, you write code.how?"
fuck
@benroyce@mastodon.social @evdelen@mstdn.ca @jupiter@mastodon.gamedev.place you probably have noto fonts <img class=“not-responsive emoji” src=“https://outerheaven.club/emoji/neofox/neofox_lul_256.png” title=“:neofox_lul:” />
-
@kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter keep two different keyboards on your desk?
@falken @kasperd @MegaMichelle @CrackMeIfYouCan @kajer @jupiter actually no.
LUKSsaves #Keycodes, not actual letters & Symbols!- Try it!
-
@mkyral @TheKeystoneCollective @jupiter Password must contain special characters, numerals and at least one vowel.
@goedelchen @mkyral @TheKeystoneCollective @jupiter Croatia left the chat
-
Czech your passwords.
@jupiter why does this remind me of some shitty track?
-
@jupiter Which website is this? That's weird! zxcvbn measures both passwords as weak and old-style (aka bad) password strength meters overestimate mixing character classes (so repeating a single character wouldn't work).
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?
-
Czech your passwords.
@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.
Example:řřřřřřřřřandřřřřřřřřřmight seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)
Compare plain pre-combinedřas U+XXXX and ASCIIrwith a combining caron coded as U+0072 then U+030c. These should render the same. -
@jupiter@mastodon.gamedev.place This is at least 9 bits of entropy, if the app doesn't normalize its Unicode strings.
Example:řřřřřřřřřandřřřřřřřřřmight seem to be different for some SW. (Idk whether my fedi client normalized the text – I'll edit if it did.)
Compare plain pre-combinedřas U+XXXX and ASCIIrwith a combining caron coded as U+0072 then U+030c. These should render the same.@jupiter@mastodon.gamedev.place
Copied and pasted from the post, you can tell they are different in the hexdump.
Fun fact: When pasted into a Vim, searching forřřřřřřřřřhighlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!řřřřřřřřř and řřřřřřřřř 00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc r..........r..r. 00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599 .r..r.. and .... 00000020: c599 c599 c599 c599 c599 c599 c599 0a ............... -
@qgustavor@urusai.social @jupiter@mastodon.gamedev.place What if the carons are combining (U+0072 then U+030c)? Are these a different character classes?
@diffie @jupiter
Depends on the implementation!One: implementations can use Unicode normalisation so it always handles them combined or always separated.
Two: zxcvbn detects repetition (and penalises it) even strings of two or more repeated substrings!
Three: for character classes-based algorithms, those are weird! IMHO in most cases those are based on "let me guess what a good password is because management asked for a password strength meter" and thus you have lots of implementations based on regex, but also ranges of ASCII ranges and all sorts of mess code. I wonder if AI still generates this messy code or if they just recommend a properly tested library like zxcvbn. I guess the first.
-
@jupiter@mastodon.gamedev.place
Copied and pasted from the post, you can tell they are different in the hexdump.
Fun fact: When pasted into a Vim, searching forřřřřřřřřřhighlights only one of the ř-words. But when I round-tripped it through XTerm (with UTF-8 enabled), the strings were normalized!řřřřřřřřř and řřřřřřřřř 00000000: 72cc 8cc5 99c5 99c5 99c5 9972 cc8c 72cc r..........r..r. 00000010: 8c72 cc8c 72cc 8c20 616e 6420 c599 c599 .r..r.. and .... 00000020: c599 c599 c599 c599 c599 c599 c599 0a ...............@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website. -
@diffie @jupiter@mastodon.gamedev.place which makes me wonder, if you allow (for the argument) non-ascii chars in passwords, should you normalize input, and where/when?
take the case of someone using a website.@Override @jupiter@mastodon.gamedev.place … or over-normalize the text.
I noticed that Discord converts my U+00a0 NBSPs to U+0020 plain spaces.
