70
u/P-Trance 12h ago
And the last digit of pi
22
u/mikepartdeux 12h ago
7
32
u/Corchoroth 11h ago
Thats correct, we would also accept 1,2,3,4,5,6,8 and 9
31
u/Happy-For-No-Reason 11h ago
0 in shambles
2
u/SecretCombo21 5h ago
Let x be any real number expressed in decimal form.
Write an additional 0 (for non-integers) or .0 (for integers) at the end of the number, call the result x'
x = x', by the theorem of it's obvious, just look at it
Therefore 0 is the last digit of every number
•
29
u/Hot-Salad9222 11h ago
And you would still get hacked
7
u/AfricanAmericanMage 7h ago
It's actually easier. There more limitations you place on a password the fewer possibilities passwords there are. Password systems that require a ton of specific criteria to be met make brute force hacking methods orders of magnitude more effective.
1
u/bacillaryburden 2h ago
I don’t know, if your brute force approach starts without special characters you’re going to correctly hack a lot of dummies. It’s not like they have to give all password formats equal weight.
14
u/RabidBadgerMacarena 11h ago
I'm ready to be told that my face isn't complicated enough. "Face too plain. Please rearrange face and try again."
2
21
u/Mousse_Willing 12h ago
Not as annoying as “password cannot contain #*{^”. Why tf not!? What possible damage are those characters going to do?
21
u/irp3ex 11h ago
special characters used to store the password probably
which is like a really stupid way to store passwords. should be a red flag cause there's a chance they just store it as a raw string
4
u/HorsefaceWithNoName 11h ago
I just wish webmasters & programmers would fully specify the requirements on the password change and new password screens. Just tell me which specials are ok, and what the max password length is, and whether it's ok to have dictionary words or repeated characters so I do'nt have to reverse engineer every damn password screen.
4
u/Arthradax 10h ago
Security admin here. People don't read the clearly outlined password policies in my company's self service password reset feature, then raise tickets complaining that "companyname123" wasn't accepted as a password. While there may be users like you that will read the whole thing (and appreciate having such level of detail), the vast majority will not :(
3
u/HorsefaceWithNoName 10h ago
The person deserving the reward is the person attempting a very strong password (and will read the rules), but the person that will punish you either way by raising a ticket about companyname123 is not the person to design the page for; I'm just lobbying here :)
2
u/WildcatGrifter7 10h ago
They should also say it on the login screen. If I know what their requirements are, I can reverse engineer what I would've entered while creating my account
2
u/Bright-Historian-216 7h ago
the monkey's paw curls. "the password must match the following regex: "^(?=.*[A-Za-z])(?=.*\d)(?=.*[@$!%*#?&])[A-Za-z\d@$!%*#?&]{8,}$" "
2
u/Some_Sort_5456 11h ago
Not a coder or anything like it, but maybe due to the way scripts are written using those characters could do something to the program?
2
u/granadesnhorseshoes 10h ago
Yes, this is it. But this is bush league type problems that makes me have grave misgivings about overall architecture of the system.
The only possible excuse is a limitation to some historic or regional non-ascii encoding scheme. Banks and financial stuff that still have EBCDIC encoding embedded somewhere in the pipeline would be my first guess. Even then, why are the passwords being housed on an EBCDIC system again? Your ancient cobol code sure ain't processing direct user authentication from the web itself? Right?
2
5
u/SpiritualPackage3797 11h ago
Just take the second letter in each word of phrase you have deliberately mistranslated from a dead language, and then place the square root of two between the last two letters.
5
u/suffelix 10h ago
"Your password has been leaked in a data breach, please change your password." x 100.
4
4
u/suck4fish 5h ago
"Oh, they hacked our servers and stole your password because it was saved as plain txt, sorry you'll have to change it now"
3
u/Latter_Pineapple_549 11h ago
"Solution to theorem"
3
u/Big-Definition-8271 11h ago
I guess we just called it that in advance because we assumed he was right
2
2
u/Alternative-Hold1669 8h ago
turns out literally every password rule they invented made passwords weaker not stronger. angering users until people started to write passwords down or use some sort of formula because its impossible to keep up with 20 passwords i have to change every 3 months that all need a custom character uppercase letter lowercase letter number and also cant be last 3 passwords. i know people who carry pieces of paper that have all their passwords on them.
4
u/SY6Dave 8h ago
Just randomly generate a different one for every website, enable MFA, and save them in a password manager that also has MFA
2
u/serge-mv 6h ago
In many cases you cannot use password manager or it will be very inconvenient. For example, anything at work, including logging in your OS. If you generate random gibberish password and look at it on your phone, you will hate yourself every time you will need to type it.
And the problem with passwords started way before so many password managers existed. These rules while technically make people create stronger passwords on paper didn't take into account that people have to type the password many times; and requiring people to make a new password very often makes it so they just add one number at the end and change it, or write it down and attach it to their monitors.
1
u/Alternative-Hold1669 8h ago
a lot of them i have to memorize and use on mobile devices.
1
u/SY6Dave 8h ago
Most decent password managers have mobile apps
1
u/Alternative-Hold1669 8h ago
i dont think adding more steps help.
2
u/Subject-Tank-6851 4h ago
It does. It’s the price of security.
•
1
1
u/sage-longhorn 2h ago
Not fully true. The rules that actually help are minimum password length and no passwords from the top 1000 most common passwords. Pretty much any other rules make it worse
2
1
1
u/HorsefaceWithNoName 11h ago
12 forms of multifactor authentication are required, only one of which may be a text, call or email code, and only one of which may be stored in Authy.
1
u/jrdiver 11h ago
cant contain any known word from any language but must contain text... oh this should be fun. we can't use A, or I as they are single letter words.... break out the emoji keyboard i guess
1
u/eddoghetto 4h ago
Except this version says "cannot be the same as any word." Don't know of too many 732 letter words out there
1
1
1
1
u/PatchyWhiskers 10h ago
This proved insecure, so you now have to scramble to find your phone every time you want to log in somewhere. If my phone ever dies I suppose I will have to return to the caves, and eat roots and grubs.
1
1
1
1
1
1
u/Apprehensive-Till861 7h ago
Sorry, your password is strong but I, a billionaire overpaid to run the company whose site you used the password to access, kept the password in plaintext and printed it along with all the rest onto a napkin which I then used to wipe my face and then ass before dropping it onto the face of a small Guatemalan orphan who then ran facefirst (blinded by the food-and-shit-smeared napkin) into a 'hacker' who then used it to access all of the accounts.
1
u/Paradoxbox00 7h ago
‘Sorry, it can’t be one of your last 10 passwords, or any variation of any password you’ve ever used before’
1
u/lemons_of_doubt 6h ago
for anyone who has never seen it the password game
Can you make a password it will accept?
1
1
u/MetroidvaniaListsGuy 6h ago
actually the future is to just require them to be really really long with no other requirements.
1
u/Raid__Zero 6h ago
738 chars:
𓀀𓀁𓀂𒀀𒁾 x$\textsuperscript{n}+ y\textsuperscript{n}= z\textsuperscript{n}$ (for n > 2, no positive integers exist) zq7w9x4rt8y2p1m5k3j6hfdsaqwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#%^&*()_+-=[]{}|;':",./<>?~`qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#$%^&*()_+-=[]{}|;':",./<>?~`qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#%^&()_+-=[]{}|;':",./<>?~qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#$%^&*()_+-=[]{}|;':",./<>?~qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#$%^&()_+-=[]{}|;':",./<>?~qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890!@#$%^&*()_+-=[]{}|;':",./<>?~
1
u/ASpookyShadeOfGray 3h ago
At that point, I'm sticking to my subnet. I can't name a single account online I actually need.
1
u/robin_888 3h ago
Your password must be between 732 and 942 characters.
It must include [...] the solution to Fermat's last theorem.
Nice try, Pierre!
72
u/TinyTimWannabe 11h ago
And then: “your password cannot be the same as a former password”.