4 ms·
Link to the actual app https://app.cinny.in/login https://app.cinny.in/login __________ EDIT: Upon registration "Password must contain 1 number, 1 uppercase l
by airstrike 5y ago
Link to the actual app https://app.cinny.in/login https://app.cinny.in/login
__________
EDIT: Upon registration "Password must contain 1 number, 1 uppercase letters, 1 lowercase letters, 1 non-alpha numeric number, 8-16 characters with no space."
Not sure if that's a Matrix limitation or just javascript validation, but if it's on your end please don't do that... if anything you're enforcing less secure passwords.
__________
EDIT 2: Hitting reload on https://app.cinny.in/register https://app.cinny.in/register leads to a 404
- usbfingers 5y agoNote, some of that is a requirement by the Matrix protocol and is out of clients control. It's ultimately up to the server to configure different password requirements. https://matrix.org/docs/spec/client_server/latest#notes-on-password-management https://matrix.org/docs/spec/client_server/latest#notes-on-p... > Clients SHOULD enforce that the password provided is suitably complex. The password SHOULD include a lower-case letter, an upper-case letter, a number and a symbol and be at a minimum 8 characters in length. Servers MAY reject weak passwords with an error code M_WEAK_PASSWORD.
- Y_Y 5y agoWhy is this still a thing? I think all tech people hate it, and all non-tech people use "Password1".
- throwamon 5y agoSome tech people hate it so much that they delegate it to a password manager. ;)
- ExtraE 5y agoAs a side-note, I wish I could give lastpass a regex or pattern or something to check auto-generate guesses against (it would be great to have a [trusted] library of these, too). I often end up regenerating or tweaking my auto generate settings a few times for every new account I create to get around this stuff.
- reidjs 5y agoPassword managers are great until you need to log in on someone else’s machine. Especially when you don’t have your device on you. It’s bitten me before.
- throwamon 5y agoIf you have hundreds of unique passwords, I don't see an alternative unless you're a savant or use predictable patterns. But that doesn't mean there aren't ways to get around it. For one, using a password manager shouldn't stop you from remembering your most important passwords, especially those you expect to use in other people's machines. You can take some extra care to make these important passwords easy to remember while still being secure. I could go on but everything I'd say is quite obvious.
- reidjs 5y agoOh I use a password manager too. Just pointing out it isn’t a catch all
- miloignis 5y agoNot to be overly pedantic, but SHOULD is not a requirement according to https://www.ietf.org/rfc/rfc2119.txt https://www.ietf.org/rfc/rfc2119.txt, but a recommendation that should be fully understood before making a different decision. I fully agree that it should be a different measure of complexity though!
- zzo38computer 5y agoWhile it can, my opinion is the client and server should not enforce anything about password strength, but MAY warn the user about weak passwords. The criteria that I think would be acceptable to be enforced includes: - A maximum (not a minimum) length, which must be suitably long, perhaps 200 bytes (or longer). - Rejecting passwords containing null bytes. - Rejecting passwords containing sequences of bytes that cannot be transmitted using the protocol, if it is necessary to transmit the password using the protocol at all (which it might not be, since it might use a hash instead). (This depends on the protocol.) - If despite the advice above, the client knows that the server will reject other passwords too, and knows precisely what the criteria are, the client can reject the same passwords. Examples of some things that should be allowed (and should not be rejected) include: - Passwords that are short. - Passwords that include your username as a substring. - Character classes/lack of character classes (e.g. you should not require nor prohibit punctuation). - Control characters (if not causing problems with the protocol like mentioned above). - Invalid UTF-8 sequences. (Just because they are allowed though, does not necessarily mean that they should be recommended.) Also, passwords should always be case-sensitive. The user should decide by themself what password they want to set, although it is OK to include advice that is optional.
- the-dude 5y agoLogin link doesn't work either.
- prophesi 5y agoThe max limit of 16 characters is odd. As for the other requirements, it's just a matter of enabling various options in your password manager's generator. And if you're not using a password manager, it's very probable you're using/reusing insecure passwords.
- wrycoder 5y agoSod42Off!
- unmole 5y agoI wonder how often 42 and 1337 are used in passwords.
- kfiven 5y agoThere are some issues related to /login and /register, but https://app.cinny.in https://app.cinny.in should work fine.
- busymom0 5y agoUsing safari's "password suggestion" generated password gives error: "Password must contain 1 number, 1 uppercase letters, 1 lowercase letters, 1 non-alpha numeric number, 8-16 characters with no space." Even an example password: apPa4SRODhLWcUa/x9HbqA== which passes all the requirements doesn't work. I would really like to use this.
- omniscient_oce 5y agoI struggled with this too. The password is too long, I had to make mine shorter
- busymom0 5y agoThanks, that helped.
- VWWHFSfQ 5y agoThis direct link will 404: https://app.cinny.in/login https://app.cinny.in/login But if you go to the homepage (index.html) and click on Login it will do the weird little SPA routing thing and load the page correctly. I'm guessing netlify needs to route every URL path to the index.html? SPA apps have just fundamentally broken the web.
- httpsterio 5y agoNo that's not a Netlify thing, it's most likely how the website is just configured.
- rozenmd 5y agoThat's not a SPA breaking the web, it's just misconfigured.
- lucideer 5y agoTechnically yes, but the fact that SPAs require explicit and extra code/configuration to make them work when this functionality (url nav) is a works-by-default inherent part of the web's core design makes them arguably broken by design.
- zzo38computer 5y agoI think that maximum 16 characters is way too short. Perhaps 127 bytes might be a suitable maximum, although it should be more if possible. (This does not mean that you are required to enter a password of at least that length; it is only the maximum length, not the minimum length.)