Comment on Scraped data of 2.6 million Duolingo users released on hacking forum

RanchOnPancakes@lemmy.world ⁨1⁩ ⁨year⁩ ago

• stevedidWHAT@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Something to note here - with AI, if you’re using any sort of heuristic for your password, it’s pretty simple to work out a pretty good set of possibilities which makes brute force even easier and puts you at risk across the board.

  Always come up with random passwords that are as random as possible. If there’s a path you took to get to a password, in theory it can be worked backward.

  For example I know some people who only change a single letter when changing their passwords which is ultimately trivial to guess if the old password was compromised (hence the need to change the password or the need to proactively work against this possibility)

  source

  • lobut@lemmy.ca ⁨1⁩ ⁨year⁩ ago

    I use a heuristic to update my main passwords. It’s not a character but easily guessable if you see it in plaintext and now you’ve made me facepalm my actions.

    I only use that for certain things because I use Google Oauth or Bitwarden for most things and you’ve just woken me up about what could be exposed.

    source

    • stevedidWHAT@lemmy.world ⁨1⁩ ⁨year⁩ ago

      The goal should usually be as random as possible, if it’s got a series of steps to create, they can be traced backward

      Now the trick I’m not telling you is that randomness is hard to get because you need a sufficient amount of entropy (basically just means randomness, chaos, formally it’s how much uncertainty there is in the system) to ensure that it’s strong enough which can be challenging sometimes. For example, if your password is only 3 characters long and has 10 possibilities for each spot in the string, you’re only looking at 10^3 possibilities to guess accurately which is nothing to pcs and people with time on their hands haha

      source
  • Tyler_Zoro@ttrpg.network ⁨1⁩ ⁨year⁩ ago

    source