Just take the string as bytes and hash it ffs

      • CaptPretentious@lemmy.worldEnglish
        4·
        24 days ago

        Yep. Having to have requirements that doesn’t flow with people very well and requiring constant updates, people WILL find shortcuts. In the office, I’ve seen sheets of paper with the password written down, I’ve seen sticky notes, I’ve seen people put them in notepad/word so they could just copy paste.

        This is made worse, because you have to go out of your way for a password manager, which means you need to know what that is. And you need a good one because there has been (and I’m going to generalize here) problems with some password managers in the past. And for work, they have to allow a password manager for that to even be an option. Which you then end up with this security theater.

        • rekabis@lemmy.caEnglish
          2·
          23 days ago

          And you need a good one because there has been problems with some password managers in the past.

          coughLastPasscough

          “Problems”. What an delightfully understated term to use.

      • Discover5164@lemm.eeEnglish
        1·
        24 days ago

        the password cannot contains the same sequences of characters as the old password.

        and i have seen this requirement in a service that requires changing it every month for some reasons.

        and this is to manage a government digital identity that allows to log it in all governments websites.

        • PM_me_your_doggo@lemmy.worldEnglish
          21·
          23 days ago

          the password cannot contains the same sequences of characters as the old password.

          That’s a weird way to say “we store your password in plaintext”

          • blackstrat@lemmy.fwgx.ukEnglish
            21·
            23 days ago

            Not necessarily. Presumably the change password form requires entering the old and new password at the same time. Then they can compare the two as plain text and hash the old password to make sure it matches, then if so, hash the new password and overwrite it. Passwords stored hashed, comparison only during the change process. A theme on this is checking password complexity rules during the login process and advising to update to something more secure. It’s possible because you’re sending the password as plain text (hopefully over a secure connection), so it can be analysed before computing the hash. This even works if the hash is salt and peppered.

    • Showroom7561@lemmy.caEnglish
      16·
      24 days ago

      Reasonable upper limits are OK. But FFS, the limit should be enough to have a passphrase with 4 or 5 words in it.

      • aname@lemmy.oneEnglish
        5·
        24 days ago

        Usually 256 bit hash is used. 256 bits is 32 bytes or 32 characters. Of course you are losing some entropy because character set is limited, but 32 characters is beyond reasonable anyway.

        • Lojcs@lemm.eeEnglish
          3·
          24 days ago

          The eff passphrase generator has about 2.5 bits of entropy per character (without word separators). Eff recommends 6 word passphrases, and with an avg word length of 7, that’s (only) 79.45 bits of entropy that won’t even fit in the 32 characters. If there wasn’t a password length limit it would be possible to saturate the hash entropy with a 20+ word & 102+ char passphrase.

          • aname@lemmy.oneEnglish
            1·
            23 days ago

            Of course, but that’s because you are using a passphrases. Passwords have a much hogher entropy.

        • Showroom7561@lemmy.caEnglish
          2·
          24 days ago

          I’d be totally fine woth 32 characters! But I’ve come across too many websites with unreasonably short (20 characters or less) limits.

    • needanke@feddit.orgEnglish
      103·
      23 days ago

      Just opened a PayPal account and their limit is 20. Plus the only 2fa option is sms 🙃.

    • rekabis@lemmy.caEnglish
      31·
      23 days ago

      Especially since it takes more effort to limit it than leave it wide open for whatever length of password a user wants to use.

      nvarchar(max) is perfect to store the hashed copy.

  • Eiri@lemmy.worldEnglish
    51·
    24 days ago

    You remind me of my bank about 17 years ago. Everyone had to have a 10-character password, exactly, and it had to include exactly 2 numbers and 1 symbol. I wasn’t very knowledgeable about computers at the time and it already felt dumb.

    • Wogi@lemmy.worldEnglish
      35·
      24 days ago

      A few years ago my ISP pushed an update to my router that changed the password requirements, invalidating my passwords. Because I couldn’t enter the old password I also couldn’t change the password. I had to do a factory reset.

      • JackbyDev@programming.devEnglish
        19·
        24 days ago

        Feels odd to check the password requirements on the enter password screen in addition to the new password screen.

        • silasmariner@programming.devEnglish
          2·
          24 days ago

          Might be checking the old password on the new password screen. Easy programming mistake to make I guess? Apply the same validation to all 3 password fields…

      • Glitterbomb@lemmy.worldEnglish
        2·
        23 days ago

        ISP worker here. Our chosen routers default to an 8 digit password, the first 4 are the last 4 of the mac in hex, which anyone can easily see being broadcast by the wifi network. The last 4 are a part of a unique serial number, but its just 0-9. Ultimately, if you try to brute force this default password, you need 10000 tries. It takes a regular GPU 2 minutes with hashcat. It baffles my mind that companies think this is OK.

    • ByteOnBikes@slrpnk.netEnglish
      15·
      24 days ago

      17 years ago, jeez. My credit Union’s website is like that. Only its between 8-12 characters. No more, no less.

      It’s terrifying.

  • guy_threepwood@lemmy.worldEnglish
    281·
    24 days ago

    I had one of those “fancy” Vodafone routers included with my broadband which had a stupid rule set on choosing the WiFi password. It’s my network, not yours, stupid router. It can be as insecure as I want.

    Anyway the rules were enforced by the JavaScript so it was easy to bypass until I got my own router to replace it with.

    • infeeeee@lemm.eeEnglish
      103·
      24 days ago

      It’s important to note, that these things are designed for the average user. If you want to change the wifi password, you are by far not an average user. Most users just plugs in and never even think about that, and the number of that kind of users are several order of magnitude higher than the conscious ones. For them it’s much more secure to set a random pw. If you let them select a password they will choose 12345 or password.

      If you know what you are doing usually it’s better to buy your own router where you can change everything the way you like.

      • JackbyDev@programming.devEnglish
        3·
        24 days ago

        If we could magically get the data I’d be willing to bet at least half of everyone thinks they can’t change their router password.

  • Machefi@lemm.eeEnglish
    151·
    24 days ago

    Assuming we can use both lower- and uppercase letters (52 in total), with the ten digits and the underscore that gives us 63 characters to work with. A random 16-character combination of these gives us 95 bits of entropy (rounding down), which is secure enough by modern standards, at least for a home router.

    Regardless, I understand the frustration of arbitrary limitations preventing you from choosing a secure password in a way that you’re comfortable with.

  • rekabis@lemmy.caEnglish
    101·
    23 days ago

    16 characters was the minimum length a password should be due to how easy it was to crack… something like a decade ago.

    Now it’s something like 20 to 24 characters.

    Seriously, if your company is defining maximum password length and demanding specific content, it is failing at the security game. Have the storage location accept a hashed UTF-8 string of at least 4096 bytes - or nvarchar(max) if it’s a database field - and do a bitwise complexity calculation on the raw password as your only “minimum value” requirement.

    Look at how KeePass calculates password complexity, and replicate that for whatever interface you are using. Ensure that it is reasonable, such as 150-200bit complexity, and let users choose whatever they want to achieve that complexity.

    • way_of_UwU@programming.devEnglish
      1·
      22 days ago

      True trash-tier software and hardware. Last year I was having trouble with frequently dropped packets from my office computer. I thought it was a Spectrum issue until I tore everything out and started testing all my ports (modem, router, wall ports, etc). I FINALLY narrowed it down to the relatively new TP-Link dumb router I bought. I threw that piece of trash in the garbage.

      Never again.

  • Frozyre@kbin.melroy.org
    6·
    24 days ago

    It’s because of shit like this, I’ve had a document containing all passwords and accounts stashed away.

    I’m going to copy and paste, fuck anyone thinking I’m going to manually enter their shit.

        • JustARegularNerd@lemmy.worldEnglish
          7·
          23 days ago

          I ran into the same issue, I didn’t want to use a cloud password manager because entrusting literally every password I have to a third party and on the internet sounds absurd to me. KeePass seemed like a good idea for me, but at the time I fell back to syncing the vault by sending it to myself in Telegram any time I made a change. Certainly not ideal

          I now just have an RPi self hosting Vaultwarden with Tailscale, and for me that’s been the best solution that keeps me happy; it’s more secure as someone needs to compromise my Tailnet first, it’s not public facing, I’m not trusting a third party to not lose my vault (a la LastPass), but its still convenient.

          • skulkingaround@sh.itjust.worksEnglish
            7·
            23 days ago

            Keepass and syncthing are great combined. Functions fully locally even when I have no access to my home network, and changes get synced between my desktop, laptop, and phone whenever I have WAN access.

            • JustARegularNerd@lemmy.worldEnglish
              2·
              23 days ago

              Yeah, I probably would have gone with that solution if I knew about it at the time, but now that I have Vaultwarden I’m pretty happy with it.

                • JustARegularNerd@lemmy.worldEnglish
                  2·
                  23 days ago

                  I’m gonna be honest, for Vaultwarden I don’t. However, a local cached copy of the vault exists on all my devices that are signed in via the official Bitwarden client, and I have recovered using this method before, so that’s my backup strategy.

          • ColonelThirtyTwo@pawb.socialEnglish
            4·
            23 days ago

            I use a keepass vault thrown in a syncthing directory but like literally any file sync will do. If you get conflicts, KeePassXC can merge them

        • dingus@lemmy.worldEnglish
          41·
          23 days ago

          Yeah, I’m with you on that. Everyone on Lemmy loves password managers, but I don’t really like the idea of entrusting all of my passwords for everything with one singular program. I actually also dislike 2 factor authentication. One time my phone broke and my bank wanted to verify my identity to purchase a new phone. Except my phone was broken so I couldn’t… Yeah I really don’t want to run into that scenario again except worse.

          I’ve actually gone old school with it and I keep most passwords physically written down in a notebook using my own cypher language/pictograms. If someone irl really wants to break into my home, find the notebook, and try to decode it, I’d be in bigger trouble to begin with. It’s very unlikely.

          • desktop_user@lemmy.blahaj.zoneEnglish
            0·
            22 days ago

            2 factor when done right is nice, however phones should Never be a requirement for anything and 2fa should require at least two physical keys before being allowed to be enabled.