Comment on NIST proposes barring some of the most nonsensical password rules

• naticus@lemmy.world ⁨1⁩ ⁨month⁩ ago

  Very common for pass phrases, and not dissuaded. Pass phrases are good for people to remember without using poor storage practices (post it notes, txt file, etc) and are strong enough to keep secure against brute force attacks or just guessing based off knowledge of the user.

  source

  • grue@lemmy.world ⁨1⁩ ⁨month⁩ ago

    On one hand, that’s true. On the other hand, a person should only need exactly one passphrase, which is the one used to unlock their password manager. Every other password should be randomly-generated and would only contain space characters by chance.

    source

    • naticus@lemmy.world ⁨1⁩ ⁨month⁩ ago

      That’s great in theory, but you’ll have passwords for logging into OSes too which password managers do not help with and you better have it memorized or you’re going to have a bad time.

      source
• lol_idk@lemmy.ml ⁨1⁩ ⁨month⁩ ago

  I’m waiting for backspace to be a valid character

  source

  • lol_idk@lemmy.ml ⁨1⁩ ⁨month⁩ ago

    Also there’s the no space space. But that’s really only useful in hacking bad implementations of html parsers or putting in your code you post online to mess with people.

    source

    • dual_sport_dork@lemmy.world ⁨1⁩ ⁨month⁩ ago

      That’s the “zero width space,” Alt + 200B for Windows users. Another favorite of mine is the nonbreaking space, Alt + 0160, which a staggering majority of web sites and other systems fail to account for.

      source
• rebelsimile@sh.itjust.works ⁨1⁩ ⁨month⁩ ago

  gosh who would want an uncommon character that obviously most average people aren’t thinking about in their passwords, that sounds like it might even be somewhat secure.

  source

  • eager_eagle@lemmy.world ⁨1⁩ ⁨month⁩ ago

    hunter 2

    unhackable

    source
• randombullet@programming.dev ⁨1⁩ ⁨month⁩ ago

  My passphrase includes several spaces. It’s another character to assist in entropy.

  source
• portifornia@lemmy.world ⁨1⁩ ⁨month⁩ ago

  I’m with you, despite seeing lemmings downvote the heck out of your comment 😢

  The reason, and specifically for whitespace at the beginning or end of a password, is that a lot of users copy-paste their passwords into the form, and for various reasons, whitespace can get pasted in, causing an invalid match. No bueno.

  Source: I’m a web developer who has seen this enough times that we had to implement a whitespace-trim validation for both setting & entering passwords.

  source

  • orclev@lemmy.world ⁨1⁩ ⁨month⁩ ago

    Trimming whitespace from the start and end of a password is fine but you absolutely should not remove whitespace from the middle of a password.

    source