• El Barto@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          1 year ago

          That’s true for all car designers. You’re referring to the shitty designers, though.

          Architects don’t get involved in the actual construction of a building either.

          • Echo Dot@feddit.uk
            link
            fedilink
            English
            arrow-up
            6
            ·
            edit-2
            1 year ago

            Oh they do. They come to tell you that the safety protocols you’ve implemented are interfering with their design.

            They’d prefer it if it looked pretty and then just fell down and light breeze thank you very much

    • Cavemanfreak@lemm.ee
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      2
      ·
      1 year ago

      All the apps I’ve used recently use QR codes (or similar measures, like a sync code) that has you log in from the phone, so it should work anyway!

      • kratoz29@lemm.ee
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        But not all apps, sadly, I just experimented it with Crunchyroll, and saw my dad struggling with a crappy app called Vix yesterday.

      • Echo Dot@feddit.uk
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        In my experience the only one that works with any degree of reliability is YouTube. Even the Netflix one can be fairly intermittent.

        Also a lot in the time you’ll go away and the hotel you’re in will have a smart TV and the software was last updated in 2011 so you have to sign in on the device.

      • lolcatnip@reddthat.com
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        edit-2
        1 year ago

        I’ve had to manually type in passwords on a TV several times in the last few months because sometimes the login for even the biggest brand-name services is just broken.

  • kureta@lemmy.ml
    link
    fedilink
    English
    arrow-up
    58
    arrow-down
    1
    ·
    1 year ago

    Security expert reveals surprising way to induce headaches

    • Echo Dot@feddit.uk
      link
      fedilink
      English
      arrow-up
      15
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Security experts don’t actually have to work on corporate IT systems.

      So you’ve set your password to contain a 😇 have you?
      Ok so how are you going to type it on this desktop computer keyboard here…
      Yeah I thought not.

      I’ll just go reset your password shall I?

        • Echo Dot@feddit.uk
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          1
          ·
          1 year ago

          I’ll let you be in charge of teaching them that. I literally had to talk someone through how to type an exclamation mark today, I don’t think they’re going to handle the extended Unicode character set.

  • kromem@lemmy.world
    link
    fedilink
    English
    arrow-up
    54
    ·
    1 year ago

    No. There’s only one piece of advice that should be given to users in 2023 about how to make their passwords stronger:

    Use a password manager

    Just use 32 character random alphanumeric passwords that are unique for each site (you can do more like 12-16 characters if you’ll ever need to enter manually).

    This is it. Stop trying to create clever passwords that you can remember. You aren’t as uniquely creative as you think and there’s been bodies of research into how the various things people do to create passwords that look secure can reduce the generation space so much that they become considerably easier to crack with an intelligent algorithm.

    Test your ability to be unpredictable

    • shucks@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      I got it to a stable 54% by using an

      algorithm

      typing f or d for consonants and vowels respectively in sentences I thought up, switching languages regularly,

      and a stable 56% by just typing randomly and adjusting my patterns based on the colored output, which might have skewed my results. Certainly a very cool tool, I also liked the explanation linked on the page!

    • vamputer@infosec.pub
      link
      fedilink
      English
      arrow-up
      19
      arrow-down
      2
      ·
      edit-2
      1 year ago

      I like doing entire phrases with some rhymes thrown in. Makes it easier to remember them.

      “BonyTonyMoansHe’sOnlyGrownLonely” has a shitload of characters, and a full sentence (even a nonsensical one like that) is more memorable to me than a random handful of disparate words.

      The more ridiculous, the better. (And, naturally, don’t forget your numbers and symbols)

      EDIT: Actually, no idea why I made it all one group of words. So long as spaces are in the password’s character space (and they very well should be if friggin’ emojis are), there’s nothing stopping you from doing an entire, punctuated sentence- other than that we’ve been conditioned not to think of a password that way.

      “Skinny Kenny’s friend, Mini Ben, has 20 chins.” That should be a fully-acceptable password with 46 characters (48 if you add the quotes), capital letters, numbers, and special characters.

      • scinde@discuss.tchncs.de
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        You can’t compare a 46 random character password to a password composed out of words, the entropy of each is very different. Your kind of password is vulnerable to dictionary attacks which are way more common and easy than brute forcing every possibility. A 50+ characters unique random password for each service that is stored in a password manager which is encrypted with a 20+ characters random password is the most secure and future proof (for now).

        • Aatube@kbin.social
          link
          fedilink
          arrow-up
          4
          arrow-down
          1
          ·
          edit-2
          1 year ago

          If the attacker doesn’t know that you’re using a dictionary password, then dictionary attacks probably won’t be their first choice. I want to remember these passwords across devices and on guests.

          • scinde@discuss.tchncs.de
            link
            fedilink
            English
            arrow-up
            5
            ·
            1 year ago

            Like someone else said on this thread; that’s just security by obscurity, which is bad. Dictionary attacks will be one of the first (brute force related) attacks attackers will use because word passwords are incredibly popular (though admittedly of fewer words: VeryBigDog34 etc…), and relatively easy to do. I agree that having the password across different devices is somewhat of a challenge with a password manager, but not impossible. My very long and complex password is all down to muscle memory by this point, I couldn’t tell you what it is from memory.

            Also you shouldn’t use the same password on multiple things and if you don’t use a password manager you will need to memorize a lot of different passwords.

        • ferret@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Dictionary attacks aren’t some magic bullet. There are a lot of english words and just four of them IS comparable in cracking difficult to a standard 8-char password that is as random as you can make it. There are a lot more words than there are symbols. Four words is obviously not as good as 46 totally random chars

          • scinde@discuss.tchncs.de
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Dictionary attacks are definitely not a magic bullet, they require a lot of processing power, just like any other brute-force attack, but not more because of their longer length, as has been implied.

            True, there are a lot of english words, but the amount of common words is relatively small. Most people aren’t going to choose a password like “MachicolationRemonstranceCircumambulationSchadenfreude”, even if it were generated for them (which is unlikely).

            Sure, it is comparable to a standard 8 characters passward, but even that kind of password is verging on the insecure (it is the absolute minimum, which should be avoided when possible).

            There are also a lot of symbols when you count emojies and the entire Unicode standard.

    • Lupec@lemm.ee
      link
      fedilink
      English
      arrow-up
      11
      ·
      1 year ago

      I love it, Bitwarden has supported generating passphrase style passwords for a while and it’s basically that. It’s my go-to these days.

      • El Barto@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        1
        ·
        edit-2
        1 year ago

        Got a source on that?

        Edit: plus brute forcing is just one scenario. I think the xkcd comic refers to using passwords in online services, and those usually have some sort of rate limiting.

    • JigglySackles@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      5
      ·
      1 year ago

      Just be sure to throw in symbols and numbers to beef it up. Dictionary words are easier to brute force.

      • notapantsday@feddit.de
        link
        fedilink
        English
        arrow-up
        20
        arrow-down
        1
        ·
        1 year ago

        The whole idea is to make it easier for humans to remember and more difficult to brute force. Long passwords are much harder to brute force than complex passwords with lots of special characters. And they’re a lot easier for humans to remember.

        There are enough words in any language that it’s virtually impossible to guess the correct four words, even if they’re in the dictionary.

        • JohnEdwa@sopuli.xyz
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          1
          ·
          1 year ago

          Even so, most password requirements will force you to add them anyway. Quick way to do it is to just pick a number on a keyboard and add it and the symbol to the end. e.g HorseBattery2# and so on.

          • Jesus_666@feddit.de
            link
            fedilink
            English
            arrow-up
            9
            ·
            1 year ago

            And requirements like that are why my password strengths are completely out of whack:

            • Random websites get 24 randomly generated printable characters stored in my password manager. This is essentially unbreakable with conventional methods and can easily be adapted to fit whichever counterproductive rules the website enforces.
            • My password manager and my home computers get memorable but long phrases. A particular favorite is to start in the middle of a line from a song and continue from there. Nobody’s going to guess “make you swear and curse when you′re chewing on” but it’s easy to memorize of you already know the song. Even a dictionary attack is going to have trouble with that many words.
            • My work accounts get the bare minimum that complies with whichever rules the admins came up with. Numbers, special characters and mixed capitalization? No thirty letter phrase for you, then; you’ll get the minimum eight characters so I have a chance of memorizing the thing. Regular password changes? Great, now the last two chargers are going to be incrementing digits, just like for everyone else.

            There’s a reason why experts these days argue against anything but minimum length restrictions.

          • ゴン太@mander.xyz
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 year ago

            You can even make a complete sentence that makes sense with symbols and numbers.

            “Ronaldo doesn’t grill 76 Canadian Tacos.”

            Or whatever

      • djdadi@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        arrow-down
        4
        ·
        1 year ago

        Not 4 of them in a row. Keep in mind the attacker doesn’t know " look for exactly 4 words"

        • Killing_Spark@feddit.de
          link
          fedilink
          English
          arrow-up
          5
          arrow-down
          1
          ·
          1 year ago

          That’s just security by obscurity. It’s one other strategy of choosing passwords that a bruteforce attack is going to try if it gets popular

          • lolcatnip@reddthat.com
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            1 year ago

            That’s not what security by obscurity means. And going by your definition, all passwords are security by obscurity.

            • Killing_Spark@feddit.de
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              If your strategy is to just use dictionary words your password will have little entropy and even less so if you use grammatically correct sentences. If the attacker knows this is your strategy of choosing passwords cracking one is way easier than cracking a password that has the same length but consists of randomly chosen characters.

              Your password is only safe because the attacker doesn’t know your strategy of choosing the password which forces him to use inefficient methods of cracking it, while there would be a more efficient way if he knew the strategy you used. Which is security by obscurity.

    • Ookami38@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      1
      ·
      1 year ago

      I prefer picking a sentence or so that has meaning to me, using the first letters, and then adjusting for numbers/symbols. So if I wanted to make that a pw, it’d be 1ppa505thm2m,utfl,atafn/5. -looks completely unintelligible, but as long as you can remember the sentence and have some ideas of how you would have encoded it, easy enough to remember/recreate.

          • lemmyvore@feddit.nl
            link
            fedilink
            English
            arrow-up
            3
            ·
            edit-2
            1 year ago

            If you’re using a password manager you don’t need phrases you can remember, you can generate even more secure passwords. Or start using passkeys.

              • Aatube@kbin.social
                link
                fedilink
                arrow-up
                1
                ·
                1 year ago

                Guest machines too. And I sorta prefer whichever browser/OS I’m using’s implementation because they’re usually styled similarly.

          • noodlejetski@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            I am, and I’m not jumping through hoops of making up a password sentence for every new website. I let Bitwarden take care of that for me.

            • Ookami38@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              Just use these methods for the pws you either need to know (like your password manager) or don’t want stored for whatever reason, like your bank. Otherwise, yeah, just let your password manager generate a password for whatever site.

        • Ookami38@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          1 year ago

          It’s as easy to remember a bunch of those as it is remembering 4 random words with no association, I think. And besides, just use that for the big, important, pws like your pw manager.

  • Dizzy Devil Ducky@lemm.ee
    link
    fedilink
    English
    arrow-up
    61
    arrow-down
    20
    ·
    1 year ago

    I’d rather staple my forehead to a telephone pole before I ever think about using an emoji in a password. Those things are abominations!

    • snek_boi@lemmy.ml
      link
      fedilink
      English
      arrow-up
      24
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Out of curiosity, what makes you say so?

      Edit: Oh. Did a “Wooosh” happen to me right now? Are you being ironic and referring to the XKCD thing about how to make a secure password using words in phrases?

      • El Barto@lemmy.world
        link
        fedilink
        English
        arrow-up
        15
        arrow-down
        2
        ·
        1 year ago

        I think OP is conflating the use of emojis in passwords with the use of emojis by the general public.

        Yes, it’s annoying to read stuff like “Hi 😃😃😃😃 I am Bob ♥️♥️♥️😎😎😎😎,” but that doesn’t mean that using them in passwords is a bad idea.

        • xor@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 year ago

          Or that “hi 😊 I’m Bob” doesn’t express a (subtly) different meaning to “hi, I’m Bob”

        • Valmond@lemmy.mindoki.com
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          4
          ·
          1 year ago

          Well they have to be the same on different devices, like you log in to Lemmy on your PC and then on your phone. Also sometimes it seems the icons change, or there are new ones and maybe old ones are removed …

          • El Barto@lemmy.world
            link
            fedilink
            English
            arrow-up
            14
            ·
            1 year ago

            Emojis are standardized. They may look different in different devices, but the code of a “raised hands” emoji will always be the same, just like the code for A is always the same.

            Removing old ones could be a problem, though.

            • Corkyskog@sh.itjust.works
              link
              fedilink
              English
              arrow-up
              5
              ·
              1 year ago

              What if I am using a device that doesn’t support emojis? wouldn’t I need to learn the code for each emoji I have used in a password?

              • El Barto@lemmy.world
                link
                fedilink
                English
                arrow-up
                5
                ·
                1 year ago

                That’s a good question, and yeah, I guess you’d either avoid using emojis or accept the fact that they’re not universally supported.

                Having said that, some people use non-ascii characters in their passwords, such as Œ which is a valid letter in some alphabets, and they’d run onto the same issue.

              • Honytawk@lemmy.zip
                link
                fedilink
                English
                arrow-up
                3
                ·
                1 year ago

                Yes

                But how many modern devices don’t somehow support emojis though?

                And how many of those you need to enter a password in?

            • Droechai@lemm.ee
              link
              fedilink
              English
              arrow-up
              3
              arrow-down
              3
              ·
              edit-2
              1 year ago

              Just like a gun is standardized to a water gun for some and a real gun for others?

              Edit: I get your point, ita just if you memorize your password with emoji icons different icons would screw up your tries to log in

              • El Barto@lemmy.world
                link
                fedilink
                English
                arrow-up
                5
                ·
                1 year ago

                If you search for “gun” in your device when selecting an emoji, just pick whatever comes up. Done.

    • fosstulate@iusearchlinux.fyi
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      Two of my colleagues still use locally stored plaintext for individual work credentials, despite having been shown where the password manager is. Both have accessed their files in front of me. If it’s not in those files it’s saved in the browser (because convenience is a hell of a drug). Now you start to see why discrete managers have a hard time, even amongst technology workers.

  • BrianTheeBiscuiteer@lemmy.world
    link
    fedilink
    English
    arrow-up
    33
    ·
    1 year ago

    Sounds great where it works but I’m sure most systems would reject an emoji or make you type out some overly complex password in addition to your emoji.

    • Toribor@corndog.social
      link
      fedilink
      English
      arrow-up
      15
      ·
      1 year ago

      Honestly you’d be surprised how many places it just works magically. I was surprised to find that Office365 users could use emojis in names for Microsoft Teams which had no problem syncing those accounts back to an on-prem Active Directory. You can use emojis to name a whole SQL database, let alone users/passwords on it.

      I keep wondering if I need to figure out how to turn that off but it hasn’t caused any problems. It’s definitely sketchy looking though when you see a bunch of normal usernames and then suddenly one is just ten snowman emojis in a row.

      • Honytawk@lemmy.zip
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        1
        ·
        1 year ago

        Emojis are just a string of special characters that get recognised and replaced by an image anyway. It is the same as using those special characters separately.

    • Echo Dot@feddit.uk
      link
      fedilink
      English
      arrow-up
      10
      ·
      1 year ago

      It’s all just Unicode so in theory a password system shouldn’t think that emoji or any more interesting than any other character. To a computer the letter B and the emoji ✈️ equivalent in that they’re both just normal characters that one can type.

      Sort of, emoji are usually treated as two or more normal characters so ✈️ might be equivalent to BB. But the basic point is the same.

    • Dark Arc@social.packetloss.gg
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      It should work reasonably well in password systems that hash the password from a UTF-8 encoding… Which should be most things really. If the system is trying to process everything with ASCII, maybe not. It might even appear to work but get converted to some other character (which is kind of the worst case)… That should be rare in web applications though

    • ArxCyberwolf@lemmy.ca
      link
      fedilink
      English
      arrow-up
      18
      ·
      1 year ago

      People who use them tend to spam the hell out of them. Like, 8 of the same emoji. And they use them every other sentence. It’s obnoxious, you only need one or two to get the point across.

    • pewgar_seemsimandroid@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      19
      arrow-down
      1
      ·
      1 year ago

      💀💀💀💀💀💀💀🗿🗿🗿🗿🗿🗿🗿🚣👍👍👍👍👍👍🔥🔥🔥🔥🔥🔥🔥 sigma

      the emojis and text above are a part of the reason

    • xthexder@l.sw0.com
      link
      fedilink
      English
      arrow-up
      18
      arrow-down
      4
      ·
      1 year ago

      Back in my day we only had 95 printable characters, and that’s the way we liked it! /s

    • Polar@lemmy.ca
      link
      fedilink
      English
      arrow-up
      30
      arrow-down
      18
      ·
      edit-2
      1 year ago

      Antisocial people.

      It was the same on Reddit. All of the people who despised emojis were often posting in really cringe and incel related subs.

      My use of emojis sky rocketed after I started dating. They are fun and convey emotion really well.

      • Honytawk@lemmy.zip
        link
        fedilink
        English
        arrow-up
        11
        arrow-down
        2
        ·
        1 year ago

        I’m convinced emojis are what has been missing from language for a long time. They are great way to portray emotions through texts, which otherwise could not be achieved.

        This way there is a difference between:

        “You are so amazing 😁👍”

        and

        "You are so amazing 🙄 "

        • mbp@lemmy.sdf.org
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          If I’m going to be relaying through to people strictly over text as much as I do these days, I better have a way to articulate it with the right emotional range to match my sparkling personality ✨

    • schnurrito@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      They didn’t exist yet when I was an early teenager, all we had were emoticons that might be replaced by images by the forum software, so of course I think they’re stupid /s

      Without sarcasm, it is a good thing we have standardized symbols now and don’t have to implement emoticon replacement into forum or chat or social media software. If only because half of such implementations replaced any occurrence of the number 8 followed by a closing parenthesis with 😎 even when that wasn’t the intended meaning (one can think of many other times one would end a parenthetical statement with the number 8).

  • Treczoks@lemm.ee
    link
    fedilink
    English
    arrow-up
    19
    ·
    1 year ago

    Completely useless from many sources where I have to rely on a keyboard for entering passwords.

  • Cosmo@lemmy.world
    link
    fedilink
    English
    arrow-up
    18
    ·
    edit-2
    1 year ago

    As a software developer who has worked with a lot of symbols and emoji… PLEASE DON’T DO THIS.

    Software doesn’t all handle these symbols the same way, and without tech knowledge (or even with) , it’s very possible to not be able to log in easily. I’m kinda drunk rn, but I’ll try to explain as simply as I can…

    For example… skintone emojis are actually two characters, a face and a skin tone modifier. I think those ones are always two characters but some of these “multi-char” characters can be normalized into a single character. But not everyone handles this the same way. For example, Safari might normalize the emoji, but Firefox might treat it as two separate characters… And this would probably make your password not match. But basically… text has lots of edge cases; I’d advise to use normal passwords please (also maybe a password manager)

    • banneryear1868@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      1
      ·
      1 year ago

      Was gonna say… you’re relying on the consistency of external emoji handlers that you don’t control. Ascii emojis are one thing.

        • banneryear1868@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          1
          ·
          1 year ago

          It was pretty normal lol. Basically everything between the visual of an emoji and what “text” is entered is not in your control. So it’s great for security but not in practice as a password. What brand was the kombucha I want some.

          • Cosmo@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            1 year ago

            I didn’t realize NYC has a physical Juneshine location. So I got a flight… and a Juneshine cocktail…

    • StarDreamer@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 year ago

      Thanks for the feedback! I’ll be sure to use non-printing characters instead of emojis for my passwords! (They can’t guess it if it’s invisible right?)

      In all seriousness, why are people so adverse to using password managers? People are plenty willing to use the browsers built-in “remind my password” instead of a proper password solution such as bitwarden… And they come up with such “hacks” just to avoid using a proper length password.