4 ms·
”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as t
by mikestew 4mo ago
”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.”
Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so…
The better idea is to require passwords with some real entropy, and get rid of expiring passwords. It’s not 1999 anymore.
- Xeoncross 4mo ago1. Open a web browser and do a search 2. Read until you find a sentence that you like. 3. Use it as your password
- ChrisRR 4mo agoI like the last line of your comment My password is now password
- hnthrow10282910 4mo agoHacked
- daredoes 4mo agoShould have been "use it as your password"
- nickweb 4mo agoThat's cool. Yours comes up as stars (*). Must be a HN thing.
- ndsipa_pomu 4mo agohunter2 doesnt look like stars to me
- jkrejcha 4mo ago"That's the best password ever!"
- alessandroberna 4mo agoNow you might want to open a pr like this one: https://github.com/danielmiessler/SecLists/pull/155 https://github.com/danielmiessler/SecLists/pull/155
- glitchc 4mo agoNot enough numbers or special characters usually.
- chopin 4mo agoI loathe two things in password requirements: special characters and not allowing spaces. C'mon, it's 2026. Require 20 characters and call it a day.
- Xeoncross 4mo ago"password is to long, max length..." (╯°□°）╯︵ ┻━┻
- Volundr 4mo agoI couldn't decide which sentence of Alice in Wonderland was my favorite, so I just used the full text.
- antonkochubey 4mo agoAlibaba Cloud in 2026 lol
- lukan 4mo agoUse one specific special character/number as word separator.
- raffraffraff 4mo agoHow about mixing up band names? Take the end of "Florence and the machine" and mix it with the start of "Rage against the machine" and you now have the totally unguessable "Rage sharing the machine". It's a different machine see?! Nobody would know that!
- NopIdoN 4mo agoThe The but the first The is from The Who
- daledavies 4mo agoThat's crazy! Imagine what The The and The Who would sound like? Not The The and The Who, but the The The and the The Who your comment alludes to. Or would the original ones be called The The The and The The Who?
- samrus 4mo agoI swear if the ghouls running things had abit more decency and allowed people to actually access and controll their passkeys then that would be the future, everyone would adopt it. The experience is so nice with key pair exchange for ssh. Its just that there i have thr security of knowing exactly where my secret is and how i can manage it, its just a file and i can move it like a file Nobody wants the risk of getting locked out because of apple and googles walled garden bullshit
- deleted 4mo ago[deleted]
- James_K 4mo agoLetting users pick their own passwords has always been a mistake. If passwords are needed, the system should choose them.
- alt227 4mo agoExpiring passwords are one of my biggest gripes, and I still see them everywhere
- grg0 4mo agoExpiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
- mschuster91 4mo agoI wouldn’t trust enterprise internet security boxes to not trip on such long text fields.
- ryandrake 4mo agoAnd content limits. Why can't my password contain the % character? No special characters? What makes a character "special"? Why can't it contain emoji? So many password systems go to great lengths to remove potential entropy and randomness from passwords with their rules. The usual excuse is "blah blah blah legacy systems" which is not a good reason.
- fph 4mo agoPersonally, I wouldn't use anything beyond ASCII in a password. I don't want encoding bugs to lock me out of my encrypted partition or bank account, thank you very much.
- sfn42 4mo agoProbably because there is some mildly decent reason (or very good, I don't know) to avoid them and it really doesn't matter enough to worry about getting around it. Why would you want emojis in your password? It's a piece of text not meant to be seen, emojis are meant to be seen. Just randomly generate some characters and get on with your life. I don't understand why you care about this at all, it's such a pointless thing to complain about.
- mikestew 4mo agoReplying to my own post: wait a minute, why are there so many accounts with the same password in the first place? Oh, because "dozens" of people are tired of changing their password every 90 days, and someone piped up on an email thread (with the subject line: "Changing passwords all the time is bullshit!", I'm sure) and said, "I just set it to $SEASON$YEAR'!'. Easy to remember, fits the policy." And now you have a system that is far less secure than if you just ditched the expiration policy to begin with.