We’ve all been there.

      • TWeaK@lemm.ee
        link
        fedilink
        English
        arrow-up
        2
        ·
        1 year ago

        Have you been given the egg yet? Don’t forget to feed him!

    • Sylver@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      1 year ago

      My Roman numerals should multiple to equal 35, but then the county I got starts with a C… how do you multiply by fractions in Roman numerals?!

    • nieceandtows@programming.dev
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      It was great until that step 20 where some ‘fire’ deleted everything I made. It’s one thing to make you think, it’s a completely different thing to just delete everything and make you start over. Fuck that noise.

      • Dandroid@dandroid.app
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        1 year ago

        Yeah, I just got to the password on fire and survived, but I wanted to move Paul to an edge so he doesn’t get killed if there’s another fire. But apparently cutting/pasting him kills him. :(

        Edit: I went back and got to rule 25. Rule 24 was a bitch and a half, but I did it. Then I had to sacrifice letters, and I thought, oh, I can’t use M or D because they are roman numerals for 1000 and 500, so I chose those. It included lowercase as well, and that made some previous rules impossible. In my anger, I may have overreacted, because I intentionally overfed Paul to kill him.

    • rustydrd@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      Man, when I played, poor Paul got burnt to a crisp. I’m still having flashbacks from that shock.

    • Rozz@lemmy.sdf.org
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I got stuck on rule 14 where I had to guess the country in Google maps.

      Au2WonderfullyshellnIcepigsXXXV!85mayy4n6mfiend🌘

      I guess it’s kind of secure. Does the password change daily with the current wordle word?

  • zeppo@lemmy.world
    link
    fedilink
    English
    arrow-up
    55
    arrow-down
    2
    ·
    1 year ago

    “Sorry, that password is already in use” ruins it for me. That’s not a realistic message to receive.

    Maybe “Your password cannot be one you’ve used previously”.

      • Tyler_Zoro@ttrpg.network
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        Yeah, this is important. Make it a really big number too so that I have to change my password lots of times in a row in order to put it back to what it was. ;)

        • 5too@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          ·
          1 year ago

          If they want to play that game - the calendar date becomes part of the password. It’s never the same, but you can always work it out!

          • UncleRummy@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Or just append a letter that increments every time you change your password, and keep a note of what the current letter is.

            Passworda
            Passwordb
            Passwordc

            When your z password expires, just wrap back around to a.

    • Buddahriffic@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      ·
      1 year ago

      It follows the vein of some of the password rules and feedback reducing security itself. Like why disallow any characters or set a maximum password length in double digits? If you’re storing a hash of the password, the hash function can handle arbitrary length strings filled with arbitrary characters. They run on files, so even null characters need to work. If you do one hash on the client’s side and another one on the server, then all the extra computational power needed for a ridiculously long password will be done by the client’s computer.

      And I bet at least one site has used the error message “that password is already in use by <account>” before someone else in the dev team said, “hang on, what?”.

      • zeppo@lemmy.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 year ago

        It’s true, most of these rules are harmful, but also most are in common use and accepted, for some reason. I have heard of a password system that had that warning, perhaps even the account, but it was in a softwaregore screenshot context.

  • Tyler_Zoro@ttrpg.network
    link
    fedilink
    English
    arrow-up
    37
    ·
    1 year ago

    Fun fact: password controls like this have been obsolete since 2020. Standards that guide password management now focus on password length and external security features (like 2FA and robust password encryption for storage) rather than on individual characters in passwords.

    • fubo@lemmy.world
      link
      fedilink
      English
      arrow-up
      21
      ·
      edit-2
      1 year ago

      Since 2017 at least; and IIRC years before that; that’s just the earliest NIST publication on the subject I could find with a trivial Web search.

      https://pages.nist.gov/800-63-3/sp800-63b.html

      Verifiers SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters) for memorized secrets. Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

      “Memorized secrets” means classic passwords, i.e. a one-factor authentication through a shared secret presumed to be known to only the right person.

    • Rufio@lemm.ee
      link
      fedilink
      English
      arrow-up
      10
      ·
      1 year ago

      I wouldn’t say obsolete because that implies it’s not really used anymore. Most websites and apps still use validation not too dissimilar from the OP, even if it goes against the latest best practices.

      • EmpatheticTeddyBear@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        I’m still waiting on an XKCD that references #936 with the fact that we soon as we have reliable, functional quantum computing, all of the passwords from before that point in time will be completely and utterly broken. That the only way to make a password that a quantum computer would have a tough time breaking is if it was made by another quantum computer. Unless of course the comic has already been made and I just missed it, which is a complete possibility because this year for me has been utterly crap.

        • Archpawn@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Some of them are broken by quantum computers, but not all of them. For example, SHA256. You can use Grover’s algorithm to take sqrt(n) steps to check n possible passwords, which on the one hand means it can be billions of times faster, but on the other hand, you just need to double the length of the password to get the same security vs quantum computers. Also, this is the first I’ve heard of a hash that uses a quantum computer. Do you have a source? Hashes need to be deterministic, and quantum computers aren’t, so that doesn’t seem like it would work very well.

          Maybe you’re getting mixed up with using quantum encryption to get around quantum computers breaking common encryption algorithms?

    • Meowing Thing@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Yeah! And nowadays the industry is pushing towards password less authentication. Github just started rolling it out to beta users

    • cley_faye@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      arrow-down
      1
      ·
      1 year ago

      People should be made aware of all the tools available to properly manage tons of passwords. Not even going too deep into “passkey” stuff or any modern shenanigans, but a password manager used to generate random passwords for each separate sites is such a simple step.

  • Eochaid@lemmy.world
    link
    fedilink
    English
    arrow-up
    34
    ·
    edit-2
    1 year ago

    Sorry, that password is already in use

    BIG red flag. Abort. Abort.

    Also I love when they only support certain special characters. So the psuedo random noise created by my password generator won’t work until I curate out the unsupported characters.

    • dancing_umbra@lemm.ee
      link
      fedilink
      English
      arrow-up
      20
      ·
      1 year ago

      I was changing my password on a pretty big company website the other day.

      The password generated by my password manager kept giving me a http error (500 I think)

      I generated a new password and deleted all the special characters other than the obvious ones. Boom, worked first time.

      So looks like someone is not sanitising their inputs properly.

      I sent them an email so hopefully they will fix.

      • Dandroid@dandroid.app
        link
        fedilink
        English
        arrow-up
        10
        ·
        1 year ago

        I sent them an email so hopefully they will fix.

        One can only hope. But based on my experience, they usually do not. I once sent an email to Microsoft telling them that their Microsoft account app had a vulnerability, and I even sent them the XML line they needed to add to their Android Manifest to fix it, and they wouldn’t do it because it required physical access to the device to exploit. I mean, that’s fair enough, but it was literally one line of code to plug the hole.

        They eventually did add that line about 6 years later.

        • dancing_umbra@lemm.ee
          link
          fedilink
          English
          arrow-up
          8
          ·
          1 year ago

          It boggles sometimes.

          I remember about 2015 (?) In the vicinity anyway, PayPal has a 12 character MAXIMUM on their passwords.

          PayPal, you know the place where you can literally transfer all the money. A 12 character MAXIMUM

          I emailed them to suggest they change this requirement. And they replied saying that 12 characters was sufficient if you used special characters and numbers.

          Glad they have finally changed it now.

    • pfannkuchen_gesicht@lemmy.one
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      Funniest thing was when I registered on a website which parsed the \0 sequence and hence truncated the password in the background unbeknownst to me. This way you could circumvent the minimum length and creare a one character password.

      • magic_lobster_party@kbin.social
        link
        fedilink
        arrow-up
        6
        ·
        1 year ago

        Once I registered on a website. I used an auto generated password. Next time I tried to log in to the website I was confused that my stored password didn’t work. Requested to change the password, but I used the stored password again. To my surprise, it said the password must be different from the current one.

        After a bit back and forth I finally figured it out. Apparently the site had a max length on the password. Any password longer than that is truncated. This truncation wasn’t applied in the login form. Only when creating a password.

    • Trapping5341@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I always just refresh the password until I get a random one without the characters the randomly choose to forbid 😂

  • SevenDigitCode@lemmy.world
    link
    fedilink
    English
    arrow-up
    31
    ·
    1 year ago

    My favorite, though, is:

    types in password “Password incorrect” goes to reset password “please enter a new password” types in password “your new password cannot be the same”

      • stepone@lemmy.world
        link
        fedilink
        English
        arrow-up
        12
        ·
        1 year ago

        It often means that one could have derived the correct password from the set of rules - but those rules are not shown when asking for the old password

        • 5too@lemmy.world
          link
          fedilink
          English
          arrow-up
          5
          ·
          1 year ago

          Exactly this. I want to normalize showing the password requirements when you don’t immediately get the password - if you made me jump through hoops the first time, at least remind me what they were!

      • tony@lemmy.hoyle.me.uk
        link
        fedilink
        English
        arrow-up
        3
        ·
        edit-2
        1 year ago

        Sometimes it means the page checking the password is following a different ruleset eg. the main page is case sensitive and the change password page isn’t. Sometimes it’s stuff like the entered password is silently truncated to a fixed number of characters and because of that won’t let you log in. Sometimes it’s wierd character expansions being passed directly to the password checking routine (&amp; or similar).

  • average650@lemmy.world
    link
    fedilink
    English
    arrow-up
    31
    arrow-down
    1
    ·
    1 year ago

    The worst part is that if they know that password is already in use… then they aren’t storing their passwords appropriately.

    • teft@lemmy.world
      link
      fedilink
      English
      arrow-up
      20
      arrow-down
      1
      ·
      1 year ago

      You could store the passwords as hashes and just compare the hashed value.

        • pewter@lemmy.world
          link
          fedilink
          English
          arrow-up
          17
          ·
          1 year ago

          True, but for the same big O they can salt the password for each user and compare it to what they have stored. My big pet peeve (that I’ve actually seen) is when they say your password is too similar to an old one. I have no idea how that could be reasonably done if they’re storing your password correctly.

  • Saneless@lemmy.world
    link
    fedilink
    English
    arrow-up
    29
    ·
    1 year ago

    My favorite is when you forget your password and try to reset it but it cries that you can’t use passwords you already used

    Mother fucker if I remembered what I used I wouldn’t be doing this

      • d3Xt3r@lemmy.world
        link
        fedilink
        English
        arrow-up
        24
        ·
        edit-2
        1 year ago

        Because it’s much more fun to come up with passphrases like Correct Battery Horse Staple.

            • Doug [he/him]
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              1
              ·
              1 year ago

              I’d rather try and remember than have a single point of failure for all my accounts’ security.

              If the passwords are stored offline then I can’t get at them if I’m away from where they’re stored. If they’re stored online they’re not secure.

              • 001100 010010@lemmy.dbzer0.com
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                1 year ago

                Some are online, but encrypted, with options to export the passwords in case the service goes down.

                “Why should I trust them?”

                Well, the software is open source, and regularly audited by people using it. Many password managers, such as Bitwarden (not sponsored, although I’d like to get a sponsorship) uses end-to-end encryption to secure the passwords so someone hacking the servers or a rogue employee can’t access anything, It would just look like random noise. You don’t have to know coding, you just have to trust that someone in the world will have the knowledge to inspect the code and report any suspicious code. Just regularly back up the passwords to a local file so you still have them in case they shut down.

                Trying to remember passwords made me constantly stressed trying to remember them. A password made life much easier. Better than a single point of failure like your brain. One password is much easier to remember, and that one password can be as complex as you want, because that’s the only one you’d have to worry about.

                Sincerely,

                Someone who’s depressed af and constantly forget passwords

                • Doug [he/him]
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  arrow-down
                  1
                  ·
                  1 year ago

                  Encryption can be decrypted. A password manager encrypting your passwords is like saying your car has working brakes. It’s totally unsafe to even consider operating without but it doesn’t say much when it is there.

                  It’s not a matter of “why should I trust them” but “why should I trust them more than the system that already exists”. I get the appeal, but the hole is big.

                  If I forget a password I reset it. If I forget my manager’s password can it be reset? Is the reset option, if extent, susceptible to attack?

                  If an account gets compromised it could have moderate repercussions, but probably minimal depending on the account, with maybe a couple exceptions. If managed passwords get compromised that’s potentially everything. There has not, and likely never will be, an impenetrable system, so it is a possibility if not a concern.

        • rebelsimile@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          1
          ·
          1 year ago

          Tacking onto this, because I mix password types too, I don’t want all my passwords in the same (even pseudorandom) style.

      • Affidavit@aussie.zone
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        Spoken like someone who has never had to deal with corporate ‘security’ before. Password managers are great, but if your workplace has incompetent IT (e.g. probs 90% of workplaces), then you’re SOL and must play the increments game.

      • TurboDiesel@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        1 year ago

        Yeah, I switched from LastPass (after one of their many data breaches) to 1Password. I don’t know any of my passwords anymore because they’re all just generated and saved automatically. And that’s a good thing.

          • ozymandias117@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            That’s inherently blocking pseudo random password generators.

            Max length doesn’t bother me if it’s at least 128 characters, but only allowing specific special characters is a sin.

            As of last year, Wells Fargo’s passwords were even cause insensitive. Dunno if they’ve fixed it since then, but probably not

      • ultimate_question@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        arrow-down
        1
        ·
        1 year ago

        Because I want control of my passwords in my head not some software, it’s not like a string of random characters is any more secure than one that can actually be remembered

    • afraid_of_zombies@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I got stuck on the chess one. Used to think I was pretty decent at the game. After a few tries I gave up and tried a few websites that claim to be able to solve it and none found the “correct” move.

      • bh11235@infosec.pub
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        “Chessify” on Android worked for me (also has the advantage that you just take a picture, instead of setting up the position by hand). Unfortunately 1 minute later the game gave me a chicken that I had to keep fed with worm emojis, so I created a stockpile of worms for the chicken and it died of overfeeding. I rage quit the game on the spot.

  • FluffyPotato@lemmy.world
    link
    fedilink
    English
    arrow-up
    27
    ·
    1 year ago

    The worst one is when it only supports up to like 16 characters but doesn’t tell you so it will only use the first 16 characters and ignore the rest. The next time you need to enter it and get the 64 character password from your password manager it will just say it incorrect and you’re left with no idea on why it’s wrong.

    • dlok@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      Holy shit you might have just explained why I have to reset my password every time for a local fast food joints own website

    • KairuByte@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      1 year ago

      I can do you one worse.

      My banking app password was not case sensitive for many, many years. They finally fixed it a few years back though!

    • Alien Surfer@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      This has happened to me so many times. Frustrating and stupid being belief. Are they hiring 10 year olds to write the html/script? Sheesh.

    • Dave@lemmy.nz
      link
      fedilink
      English
      arrow-up
      25
      arrow-down
      1
      ·
      1 year ago

      60 character alphanumeric randomly generated password: sorry, that password is not secure enough, please include a special character

      Type “Letmein69!” : perfect, very secure password

      Me: 🤨

      • dancing_umbra@lemm.ee
        link
        fedilink
        English
        arrow-up
        13
        ·
        1 year ago

        Yeah that really bugs me.

        Like come one, “Ma5terp!ece” is more secure than “Regain Refinance Clarify Cuddle9”

        Maybe in bizaro world.

    • SSTF@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      edit-2
      1 year ago

      Unfortunately a lot of jobs require passwords and they use outdated security processes, forcing people to have the old fashioned “must have uppercase, lowercase, number, and special character & you have to change it every 3 months for no reason” passwords instead of the stronger (and less annoying) alternatives.

      • funkless@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        1 year ago

        i signed up at mba.com and it wouldn’t let me use a password because it contained a semicolon which wasn’t on the approved list of special characters, and then - get this - because I tried too many times to create a password - locked me out because I had “too many failed attempts”

      • CoderKat@lemm.ee
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        Those requirements drive me crazy, especially because they’re all against NIST recommendations. Someone thinks they make passwords more secure but they have the opposite effect.

        At any rate, password managers still help in those cases. If nothing else, for providing a safe place to record what your password is for when you forget it because of the dumb requirements.

        • SSTF@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 year ago

          I always wonder if such choices come from incompetent IT, or if IT wants to do things better but is banging their heads against corporate owners who think “more hassle = more secure”.

          • peto (he/him)@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            It’s almost certainly that writing security standards for an organization takes time and needs approval from high up. And someone high up complaining that they only just revised them to include special characters.

      • mikiao@lemmy.world
        link
        fedilink
        English
        arrow-up
        5
        ·
        1 year ago

        Must be changed every month, can’t use a previous password, AND, for some fucking reason, can only contain 8 characters.

        And if you forgot your password, you can call IT and they’ll just read it to you because they have them all saved somewhere.

        That was a great place to work at.

      • darkkite@lemmy.ml
        link
        fedilink
        English
        arrow-up
        5
        arrow-down
        1
        ·
        1 year ago

        that’s exactly why a password manager works. there’s a generator that you can configure to meet requirements

    • Archpawn@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Still frustrating. I generally try to make my passwords all lowercase in case I need to type them (especially on a phone). But a lot of places don’t allow that.

    • Corhen@lemmy.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      i wouldn’t even mind if it was 32. 32 is a damn strong password.

      I’ve seen as low as 10 digits in the past

      • iopq@lemmy.world
        link
        fedilink
        English
        arrow-up
        8
        ·
        1 year ago

        My Wells Fargo password used to be max 8 characters, and when you use the phone you you can basically use the keypad to log in.

        So it’s basically 8 DIGITS

      • graphite@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        edit-2
        1 year ago

        32 is a damn strong password

        Not necessarily: only if it’s generated properly, and only for the moment - that will change in the next few years.

        You do realize that length and symbol type are only 2 out of many other factors that go into a strong password?

        • Corhen@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Ok, fair, not all 32 digit passwords will be secure.

          11111111111111111111111111111111 is not secure, but I was trying to imply, in a properly generated password, 32 digits long is very secure.

          • graphite@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            edit-2
            1 year ago

            but I was trying to imply, in a properly generated password, 32 digits long is very secure.

            I understand, and I think you make a valid point as far as the discussion is concerned.

            It’s unfortunately still a little more complicated than that, though.

            Like I said, there’s more to a password than length and symbol type.

            Even something like cF*+@aXbIdFHje2vZiU-1 is less secure than if it were generated by a good PRNG.

            D0@ndro!dsDr@3@m0f3l3ctr!cSh33p? is also insecure, though it might have been considered secure 4-5 years ago.

            You see what I’m saying?

            Then of course there’s hash algorithms and how those are used to authenticate the passwords themselves, etc.

    • Revan343@lemmy.ca
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      You think that’s bad, a decade ago I had to use a government-run website that required passwords be exactly 8 characters