Same. My country was Jordan. Took way too long to figure out, because it dropped me in the middle of an empty amphitheater with no visible road signs, license plates, etc…

I'm starting to want to learn chess after learning about the password game. I need to go get further!

Qxh6

Have you been given the egg yet? Don't forget to feed him!

You don't need capital letters in the country name

Yeah, I just got to the password on fire and survived, but I wanted to move Paul to an edge so he doesn't get killed if there's another fire. But apparently cutting/pasting him kills him. :(

Edit: I went back and got to rule 25. Rule 24 was a bitch and a half, but I did it. Then I had to sacrifice letters, and I thought, oh, I can't use M or D because they are roman numerals for 1000 and 500, so I chose those. It included lowercase as well, and that made some previous rules impossible. In my anger, I may have overreacted, because I intentionally overfed Paul to kill him.

if you walk down the path like 20m there's a sign that tells you where you are

I stopped playing when my whole password caught fire lmao

it does change a lot with every try

Yeah, this is important. Make it a really big number too so that I have to change my password lots of times in a row in order to put it back to what it was. ;)

Especially for those places that want your password changed every two weeks.

At my work they wanted better security, and made the rule of minimum 12 characters, must include all sorts of numbers, special characters, etc, no previously used password and it must be changed every month, 3 attempts then the account is locked and you have to call IT.

The result was that people wrote their passwords on post-its on the screen, so it led to worse security overall and they had ro relax the rules.

It's true, most of these rules are harmful, but also most are in common use and accepted, for some reason. I have heard of a password system that had that warning, perhaps even the account, but it was in a softwaregore screenshot context.

Yeah, the most recent one for me was creating a password at lemmy.world

I wouldn’t say obsolete because that implies it’s not really used anymore.

I'm not sure where you heard someone use the word "obsolete" that way, but I assure you that there are thousands if not millions of examples of obsolete technologies in constant and everyday use.

I'm still waiting on an XKCD that references #936 with the fact that we soon as we have reliable, functional quantum computing, all of the passwords from before that point in time will be completely and utterly broken. That the only way to make a password that a quantum computer would have a tough time breaking is if it was made by another quantum computer. Unless of course the comic has already been made and I just missed it, which is a complete possibility because this year for me has been utterly crap.

Except you can run a dictionary attack on that and suddenly it's only 4 variables that are cracked way faster than the first password.

Except you can run a dictionary attack on that and suddenly it's only 4 variables that are cracked way faster than the first password.

I take a tiered approach: I use Chrome's password manager for things I don't care all that much about. I use PasswordSafe in a shared file in cloud storage for passwords that I care a bit more about. And for those very few that are incredibly important to me, I just memorize the password that's usually made up of some long nonsense phrase (e.g. "apple youth brandish frobnitzer brainiac") which has enough obscure words to necessitate a very hefty dictionary to crack (or even a made up word or two).

Of course, I also have to memorize my Google and PasswordSafe passwords, since writing those down would compromise the first two storage systems.

I sent them an email so hopefully they will fix.

One can only hope. But based on my experience, they usually do not. I once sent an email to Microsoft telling them that their Microsoft account app had a vulnerability, and I even sent them the XML line they needed to add to their Android Manifest to fix it, and they wouldn't do it because it required physical access to the device to exploit. I mean, that's fair enough, but it was literally one line of code to plug the hole.

They eventually did add that line about 6 years later.

Password1'); DROP TABLE Passwords;--

Once I registered on a website. I used an auto generated password. Next time I tried to log in to the website I was confused that my stored password didn’t work. Requested to change the password, but I used the stored password again. To my surprise, it said the password must be different from the current one.

After a bit back and forth I finally figured it out. Apparently the site had a max length on the password. Any password longer than that is truncated. This truncation wasn’t applied in the login form. Only when creating a password.

It often means that one could have derived the correct password from the set of rules - but those rules are not shown when asking for the old password

i have had this happen on some websites occasionally while using my password manager.

Sometimes it means the page checking the password is following a different ruleset eg. the main page is case sensitive and the change password page isn't. Sometimes it's stuff like the entered password is silently truncated to a fixed number of characters and because of that won't let you log in. Sometimes it's wierd character expansions being passed directly to the password checking routine (& or similar).

yes, but then they are not salted, which is what they should be doing.

So secure even you don't know the password. It's like built in MFA.

Why do you have an account for your local fast food joint?!

This was me on a bank's site till I clued in that I need to shorten my password.

Because it's much more fun to come up with passphrases like Correct Battery Horse Staple.

Spoken like someone who has never had to deal with corporate 'security' before. Password managers are great, but if your workplace has incompetent IT (e.g. probs 90% of workplaces), then you're SOL and must play the increments game.

Yeah, I switched from LastPass (after one of their many data breaches) to 1Password. I don't know any of my passwords anymore because they're all just generated and saved automatically. And that's a good thing.

Tons of websites reject pseudo randomly generated passwords, too

Because I want control of my passwords in my head not some software, it's not like a string of random characters is any more secure than one that can actually be remembered

Me too.

That was my limit too!

It was crone btw.

i signed up at mba.com and it wouldn't let me use a password because it contained a semicolon which wasn't on the approved list of special characters, and then - get this - because I tried too many times to create a password - locked me out because I had "too many failed attempts"

Those requirements drive me crazy, especially because they're all against NIST recommendations. Someone thinks they make passwords more secure but they have the opposite effect.

At any rate, password managers still help in those cases. If nothing else, for providing a safe place to record what your password is for when you forget it because of the dumb requirements.

Must be changed every month, can't use a previous password, AND, for some fucking reason, can only contain 8 characters.

And if you forgot your password, you can call IT and they'll just read it to you because they have them all saved somewhere.

That was a great place to work at.

that's exactly why a password manager works. there's a generator that you can configure to meet requirements

Yeah that really bugs me.

Like come one, "Ma5terp!ece" is more secure than "Regain Refinance Clarify Cuddle9"

Maybe in bizaro world.

But what if the password you want to set is already in use?

Ultimately that makes it easier to break.

How many people do you suppose don't exceed minimum requirements? Once you've got that you can reduce how much you need to generate.

Yeah, you can get that by going to the sign up process, but it generates an extra step that would also increase automation/scraping efforts since it's rarely in the same place.

My Wells Fargo password used to be max 8 characters, and when you use the phone you you can basically use the keypad to log in.

So it's basically 8 DIGITS

32 is a damn strong password

Not necessarily: only if it's generated properly, and only for the moment - that will change in the next few years.

You do realize that length and symbol type are only 2 out of many other factors that go into a strong password?

Large Brian Moment, for real

It MIGHT not be as bad as you think. If the UI was just terrible at communicating and what it actually meant was, "that password is in our database of known compromised passwords," then that would be reasonable. Google does this now too, but I think they only do it after the fact (e.g. you get a warning that your password is in a database of compromised passwords).

Boomer memes

Yeah that nearly makes me want to smash something when it happens. Anyone that silently truncates passwords should NOT do it, or at least truncate the creation AND login forms. Just say the limit and give a error, or handle extra input the way you're supposed to in the enceyption algorithm and hash it to to the correct length. A length limit of say, the amount of bits the encryption key has, like 32/64/128 chracters for 256/512/1024 bit, is reasonable, any other limit is stupid.

YES, I have hit this too!

Here is an alternative Piped link(s): https://piped.video/zRFDr8Vgp_Q

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source, check me out at GitHub.

Of course, requiring at least one symbol or upper case letter etc is a good idea, along with a minimum length. Many websites won't let you use a password longer than a certain amount of characters. The only reason for that limitation is that they are storing the database field as plaintext, and anything longer will not fit into that column.

How is it not true? If a site is saying for example, "password must be less than 20 characters" -- that is purely a limitation based on the size of the database field, which you can only assume it's being adding to that field as plain text. A hash will always be the same length and password length would not matter.