Dude makes a whole binary of a virus his password.

What is an EICAR test string?

Unfortunately there is significant overlap between plain-text-password-servers and servers that can't be bothered to use antivirus. Also, the string may not work if it's not at the start of the file. AV often doesn't process the whole file for efficiency purposes.

Sadly it wouldn't work if found in a CSV file with other records:

According to EICAR's specification the antivirus detects the test file only if it starts with the 68-byte test string and is not more than 128 bytes long. As a result, antiviruses are not expected to raise an alarm on some other document containing the test string

unfortunately, nearly all AV abides by the “cannot be larger than 68 bytes” rule

According to EICAR's specification the antivirus detects the test file only if it starts with the 68-byte test string and is not more than 128 bytes long.

Unless you're the only one in the dump, no :c

Single quotes are another great way to mess with unsanitized data input though

I'm watching the collective knowledge of my civilization crumble and I'm powerless to stop it

Commas might be the comma's property. Step off.

Yeah, but look at how many extra comments that generates. I'm starting to think that intentionally bad grammar is sometimes a good social media tactic to create engagement on top of what you're already doing, but I'm not excluding people being just plain illiterate.

The apostrophe is to announce that the next letter will be an 'S'!

You're possessed by a GrammarNazi spirit!

An apostrophe might have an even better effect than a comma. PSA: Don't shoot yourself in the foot by escaping commas or apostrophes! Like in password:",\,',\''!DROP TABLE(''users')" That's more likely to "trick" the log on machine that to bust a CSV file.

add apostrophes to your meme to increase engagemeot

noice! Did the '; DROP TABLE USERS;' respond?

Like the Bobby tables? Can u put it in a coffee?

Bobby', --

SQL injection in the big 2025...

Crazy

Beat me to it.

They had to put a comma in there somewhere. Even of it was in the wrong place and upside down.

How* it works

Until next time

I think it's actually to protect the words from the evil S's.

It works like that in Dutch though. For example in Dutch the plural form for “baby” is “baby’s“

So the person who made this meme probably speaks Dutch.

Dont tel'l m'e w'ha't t'o 'do'''''! :)

Can be != will be

You're looping over 50M records, extracting into your csv. Did you bother using the appropriate library, or did your little perl script just do split(/,/,$line)

What about quotes (single/double) and \s mixed with commas?

Once in a while you come across fools like me who write it all from scratch cause it's fun. Live and learn

\"?

A perspective from someone who red teams for a living:

If I encounter a password like that, I'm probably going to pay special attention to your account among the millions. Commas dont stop most people from being weak to password permutations either.

intermix the , and the ; as well, in case the CSV uses a different separator.

I think Python csv would save that as "Pass\",\"words\",\"Are\",\"fun\",\"\\n" and then it would be read by Excel / LibreOffice / Python csv as expected.

What if it's exported as a tsv?

CSV existed for over 30 years before RFC 4180. Excel, and countless other tools, have their own incompatible variants. Excel in particular is infamous for mangling separators when exporting to CSV.

That standard won't stop me because I can't read!

yeah unless you’re dealing with some steaming pile of vibe-coded shit this is a dumb as fuck idea.

(have seen people who don’t know how to appropriately use an LLM just let it wholly reimplement standards, read it over, and then say “oh wow that works great!” smh…)

You would be surprised how many people are simply splitting the string on commas instead of using an actual ascii parser. Especially for one off scripts, like churning through a csv full of passwords.

Then add escape sequence to your password!

Real passwords contain ASCII 0.

Hm, now you're making me wonder how feasible it would be to use Emojis in my passwords...

OP is uninformed and just found it funny and worth sharing. Good day

Little bobby tables is a joke for a good reason

Security researchers are releasing password dumps? 🤔

OP has never touched a PC in their life.

Yes and no. Like yes, that can be true. But a lot of tools don’t handle commas correctly no matter how you escape them.

Only if it's actually using a standard like rfc 4180 https://www.ietf.org/rfc/rfc4180.txt

Also just noticed it specifies CRLF as the line ending, not LF, which is kind of weird.

A CSV is just a long string of text with a few control characters tossed in for end lines. There are practically no rules enforced by the file type itself. You can dump that unsanitized and poorly awk'd data into whatever awful mess you want. Nobody's stopping you. Sure, excel will force it's CSV formatting rules on you when you export like a child's training wheels. But that's not relevant here.

Great, now I can get your account.

I'm afraid it might break the website where you were trying to sign up.

For the less informed, what might that look like?

From personal experience, whenever I've put a space in, I am told that spaces are not allowed. I tend to resort to using the minus sign " - " or the underscore sign " _ " in its place.

You can try \t. Try adding a bell while you're at it.

Kinda yes, but really no. If they assume there is always a comma, but if you add it after you've generated whatever password you've chosen you're still making it harder for them. You haven't compromised on the length, and now they need to figure out where in the rest of your random password the comma goes.

ASCII values 0x1C through 0x1F: are we a joke to you?

Never heard of a tsv

Wow an actual unpopular opinion. They're always in the comments.