this post was submitted on 14 Aug 2024
596 points (96.3% liked)

Privacy

32165 readers
596 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

It is truly upsetting to see how few people use password managers. I have witnessed people who always use the same password (and even tell me what it is), people who try to login to accounts but constantly can't remember which credentials they used, people who store all of their passwords on a text file on their desktop, people who use a password manager but store the master password on Discord, entire tech sectors in companies locked to LastPass, and so much more. One person even told me they were upset that websites wouldn't tell you password requirements after you create your account, and so they screenshot the requirements every time so they could remember which characters to add to their reused password.

Use a password manager. Whatever solution you think you can come up with is most likely not secure. Computers store a lot of temporary files in places you might not even know how to check, so don't just stick it in a text file. Use a properly made password manager, such as Bitwarden or KeePassXC. They're not going to steal your passwords. Store your master password in a safe place or use a passphrase that you can remember. Even using your browser's password storage is better than nothing. Don't reuse passwords, use long randomly generated ones.

It's free, it's convenient, it takes a few minutes to set up, and its a massive boost in security. No needing to remember passwords. No needing to come up with new passwords. No manually typing passwords. I know I'm preaching to the choir, but if even one of you decides to use a password manager after this then it's an easy win.

Please, don't wait. If you aren't using a password manager right now, take a few minutes. You'll thank yourself later.

you are viewing a single comment's thread
view the rest of the comments
[–] floofloof@lemmy.ca 60 points 3 months ago (7 children)

My favorite is the sites that silently truncate your password to a maximum length only they know, before storing it. Then when you come back you have to guess which substring of your password they actually used before you can log in. Resetting doesn't help unless you realize they're doing this and use a short one.

[–] Preflight_Tomato@lemm.ee 25 points 3 months ago (1 children)

My favorite was the password set screen allowing up to 64 characters, but login fails if the password is over 32 chars.

[–] viking@infosec.pub 6 points 3 months ago

My webhost allows passwords of all length and complexities in the password set field, but will strip $ and & on the login mask on their main website, like in the top right corner.

A failed login will automatically bring you to a dedicated login.xxx.yyy subdomain and prompt a password reset, but if you use the login mask there instead, the exact same password works.

[–] jollyrogue@lemmy.ml 7 points 3 months ago

Login and password set/reset forms being out of sync is a classic. 😆

I haven’t seen that one in a while luckily.

I like the password in my thinkpad's bios that's case sensitive when entering it to log in, but setting the password it's not. That took me a while to figure out.

[–] KickMeElmo@sopuli.xyz 3 points 3 months ago

Similarly, sites that don't handle backslashes properly. I've had a few where I had to use my password sans all the backslashes because it interpreted them as an escape character.

[–] Passerby6497@lemmy.world 3 points 3 months ago

Omfg, one of my banks did this to me and was infuriating. I was able to call in to fix it and made a bug report, but goddamn, what idiot silently truncates the sign up password but not also the login form?!?