this post was submitted on 26 Aug 2024
462 points (95.5% liked)

Mildly Infuriating

35045 readers
106 users here now

Home to all things "Mildly Infuriating" Not infuriating, not enraging. Mildly Infuriating. All posts should reflect that.

I want my day mildly ruined, not completely ruined. Please remember to refrain from reposting old content. If you post a post from reddit it is good practice to include a link and credit the OP. I'm not about stealing content!

It's just good to get something in this website for casual viewing whilst refreshing original content is added overtime.


Rules:

1. Be Respectful


Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.

Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.

...


2. No Illegal Content


Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.

That means: -No promoting violence/threats against any individuals

-No CSA content or Revenge Porn

-No sharing private/personal information (Doxxing)

...


3. No Spam


Posting the same post, no matter the intent is against the rules.

-If you have posted content, please refrain from re-posting said content within this community.

-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.

-No posting Scams/Advertisements/Phishing Links/IP Grabbers

-No Bots, Bots will be banned from the community.

...


4. No Porn/ExplicitContent


-Do not post explicit content. Lemmy.World is not the instance for NSFW content.

-Do not post Gore or Shock Content.

...


5. No Enciting Harassment,Brigading, Doxxing or Witch Hunts


-Do not Brigade other Communities

-No calls to action against other communities/users within Lemmy or outside of Lemmy.

-No Witch Hunts against users/communities.

-No content that harasses members within or outside of the community.

...


6. NSFW should be behind NSFW tags.


-Content that is NSFW should be behind NSFW tags.

-Content that might be distressing should be kept behind NSFW tags.

...


7. Content should match the theme of this community.


-Content should be Mildly infuriating.

-At this time we permit content that is infuriating until an infuriating community is made available.

...


8. Reposting of Reddit content is permitted, try to credit the OC.


-Please consider crediting the OC when reposting content. A name of the user or a link to the original post is sufficient.

...

...


Also check out:

Partnered Communities:

1.Lemmy Review

2.Lemmy Be Wholesome

3.Lemmy Shitpost

4.No Stupid Questions

5.You Should Know

6.Credible Defense


Reach out to LillianVS for inclusion on the sidebar.

All communities included on the sidebar are to be made in compliance with the instance rules.

founded 1 year ago
MODERATORS
 

Just take the string as bytes and hash it ffs

top 50 comments
sorted by: hot top controversial new old
[–] magic_lobster_party@fedia.io 196 points 3 weeks ago (9 children)

There’s a special place in hell for those who set an upper limit in password lengths.

[–] CosmicTurtle0@lemmy.dbzer0.com 61 points 3 weeks ago (6 children)

I sort of get it. You don't want to allow the entire work of Shakespeare in the text field, even if your database can handle it.

16 characters is too low. I'd say a good upper limit would be 100, maybe 255 if you're feeling generous.

[–] owsei@programming.dev 89 points 3 weeks ago (21 children)

The problem is that you (hopefully) hash the passwords, so they all end up with the same length.

[–] expr@programming.dev 58 points 3 weeks ago (3 children)

At minimum you need to limit the request size to avoid DOS attacks and such. But obviously that would be a much larger limit than anyone would use for a password.

[–] owsei@programming.dev 27 points 3 weeks ago

Also rate of the requests. A normal user isn't sending a 1 MiB password every second

load more comments (2 replies)
load more comments (20 replies)
[–] i_am_not_a_robot@feddit.uk 23 points 3 weeks ago (4 children)

The eBay password limit is 256 characters.

They made the mistake of mentioning this when I went to change my password.

Guess how many characters my eBay password has?

[–] n3cr0@lemmy.world 10 points 3 weeks ago

Just paste it in here and I count the characters for you.

load more comments (2 replies)
[–] Saik0Shinigami@lemmy.saik0.com 16 points 3 weeks ago (10 children)

I sort of get it. You don’t want to allow the entire work of Shakespeare in the text field, even if your database can handle it.

You don't store the original text. You store the hash of it. If you SHA512 it, anything that's ever given in the password field will always be 64Bytes.

The only "legit" reason to restrict input to 16 character is if you're using an encryption mechanism that just doesn't support more characters as an input. However, if that's the case, that's a site I wouldn't want to use to begin with if at all possible.

load more comments (10 replies)
load more comments (3 replies)
[–] CeruleanRuin@lemmings.world 52 points 3 weeks ago (6 children)

Oh and also, "change this every four weeks please."

Okay then. NEW PASSWORD: pa$$word_Aug24

[–] fritolay@lemmy.one 19 points 3 weeks ago (2 children)

Invalid password, maximum 13 characters.

load more comments (2 replies)
load more comments (5 replies)
[–] Showroom7561@lemmy.ca 17 points 3 weeks ago (4 children)

Reasonable upper limits are OK. But FFS, the limit should be enough to have a passphrase with 4 or 5 words in it.

load more comments (4 replies)
[–] needanke@feddit.org 7 points 2 weeks ago (3 children)

Just opened a PayPal account and their limit is 20. Plus the only 2fa option is sms 🙃.

[–] JustARegularNerd@lemmy.world 10 points 2 weeks ago (1 children)

I just double checked and I have TOTP enabled for my PayPal account so it should be an option.

I just found this support article of theirs and it says it can only be enabled through their website and not through the app (why?!) so you might be running into that?

https://www.paypal.com/uk/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167

load more comments (1 replies)
load more comments (2 replies)
load more comments (5 replies)
[–] UpperBroccoli@lemmy.blahaj.zone 64 points 3 weeks ago (5 children)

English letters? Really? So basically no a-z, only Æ, Þ, Ƿ, Ð?

[–] ImplyingImplications@lemmy.ca 47 points 3 weeks ago

Ye olde passwarde

[–] fartsparkles@sh.itjust.works 28 points 3 weeks ago (1 children)

What have the Romans ever done for us?

[–] Spot@startrek.website 14 points 3 weeks ago (2 children)
[–] fartsparkles@sh.itjust.works 19 points 3 weeks ago (1 children)

Well, yeah. Obviously the roads. I mean, the roads go without saying, don’t they? But apart from the sanitation, the aqueducts, and the roads…

[–] Spot@startrek.website 10 points 3 weeks ago (1 children)

Irrigation! I need to rewatch this, it's been too long.

[–] fartsparkles@sh.itjust.works 11 points 3 weeks ago (1 children)

All right, but apart from the sanitation, the medicine, education, wine, public order, irrigation, roads, a fresh water system, and public health, what have the Romans ever done for us?

[–] Spot@startrek.website 7 points 3 weeks ago

Brought peace?

load more comments (1 replies)
[–] egrets@lemmy.world 17 points 3 weeks ago (1 children)

Also Œ, Ȝ, and arguably W and U.

[–] drolex@sopuli.xyz 19 points 3 weeks ago

Anglo-saxons got the UWU, nice

load more comments (2 replies)
[–] Eiri@lemmy.world 54 points 3 weeks ago (3 children)

You remind me of my bank about 17 years ago. Everyone had to have a 10-character password, exactly, and it had to include exactly 2 numbers and 1 symbol. I wasn't very knowledgeable about computers at the time and it already felt dumb.

[–] Wogi@lemmy.world 36 points 3 weeks ago (3 children)

A few years ago my ISP pushed an update to my router that changed the password requirements, invalidating my passwords. Because I couldn't enter the old password I also couldn't change the password. I had to do a factory reset.

[–] JackbyDev@programming.dev 20 points 3 weeks ago (2 children)

Feels odd to check the password requirements on the enter password screen in addition to the new password screen.

load more comments (2 replies)
load more comments (2 replies)
[–] ByteOnBikes@slrpnk.net 15 points 3 weeks ago

17 years ago, jeez. My credit Union's website is like that. Only its between 8-12 characters. No more, no less.

It's terrifying.

[–] RecluseRamble@lemmy.dbzer0.com 11 points 3 weeks ago (1 children)

At that time my bank allowed up to 6 digits as a password. I kid you not, like a card PIN but for online banking login. I believe the whole banking security relies on their backoffices still running on paper.

load more comments (1 replies)
[–] 9point6@lemmy.world 41 points 3 weeks ago (3 children)
[–] gratux@lemmy.blahaj.zone 12 points 3 weeks ago (1 children)

german programmers trying to translate Unterstrich

load more comments (1 replies)
[–] dohpaz42@lemmy.world 8 points 3 weeks ago

/^\w{6,16}$/

load more comments (1 replies)
[–] guy_threepwood@lemmy.world 31 points 3 weeks ago (1 children)

I had one of those “fancy” Vodafone routers included with my broadband which had a stupid rule set on choosing the WiFi password. It’s my network, not yours, stupid router. It can be as insecure as I want.

Anyway the rules were enforced by the JavaScript so it was easy to bypass until I got my own router to replace it with.

[–] infeeeee@lemm.ee 7 points 3 weeks ago (1 children)

It's important to note, that these things are designed for the average user. If you want to change the wifi password, you are by far not an average user. Most users just plugs in and never even think about that, and the number of that kind of users are several order of magnitude higher than the conscious ones. For them it's much more secure to set a random pw. If you let them select a password they will choose 12345 or password.

If you know what you are doing usually it's better to buy your own router where you can change everything the way you like.

load more comments (1 replies)
[–] possiblylinux127@lemmy.zip 15 points 3 weeks ago

Create a randomly generated password and store it in a password manager

[–] Machefi@lemm.ee 15 points 3 weeks ago

Assuming we can use both lower- and uppercase letters (52 in total), with the ten digits and the underscore that gives us 63 characters to work with. A random 16-character combination of these gives us 95 bits of entropy (rounding down), which is secure enough by modern standards, at least for a home router.

Regardless, I understand the frustration of arbitrary limitations preventing you from choosing a secure password in a way that you're comfortable with.

[–] InSamsara@lemmy.world 12 points 2 weeks ago

Not allowing 20 character passwords is criminal, my bank does this.

[–] Carighan@lemmy.world 11 points 3 weeks ago

Just do the Password Game to figure out a good one!

[–] peter@lemmy.emerald.show 9 points 2 weeks ago (1 children)

I hate that kind of stuff, when I see this I wonder if they hash the password at all

load more comments (1 replies)
[–] const_void@lemmy.ml 9 points 2 weeks ago

Lol. Imagine thinking TP Link takes security seriously.

[–] doggle@lemmy.dbzer0.com 9 points 2 weeks ago (4 children)

admin wouldn't even work. It's too short.

load more comments (4 replies)
[–] rekabis@lemmy.ca 9 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

16 characters was the minimum length a password should be due to how easy it was to crack… something like a decade ago.

Now it’s something like 20 to 24 characters.

Seriously, if your company is defining maximum password length and demanding specific content, it is failing at the security game. Have the storage location accept a hashed UTF-8 string of at least 4096 bytes - or nvarchar(max) if it’s a database field - and do a bitwise complexity calculation on the raw password as your only “minimum value” requirement.

Look at how KeePass calculates password complexity, and replicate that for whatever interface you are using. Ensure that it is reasonable, such as 150-200bit complexity, and let users choose whatever they want to achieve that complexity.

load more comments (1 replies)
[–] Blaster_M@lemmy.world 9 points 2 weeks ago (1 children)

TP-Link.... TP-Link...

I don't trust your bottom barrel software, TP-Link...

load more comments (1 replies)
[–] skullgiver@popplesburger.hilciferous.nl 8 points 3 weeks ago* (last edited 3 weeks ago)

Depending on how they do their length check, this "English only" check makes sense in a way. Non-ascii letters are a pain to validate the length of ("🏴󠁧󠁢󠁳󠁣󠁴󠁿" is seven code points and fourteen bytes long, but just one "character" to most people).

I don't know why the max length is that low (I presume it's stored in plaintext) but you can't expect someone to write a good password strength algorithm from a company producing the cheapest routers imaginable.

load more comments
view more: next ›