I’ve used the same password for everything since 1991. If anyone’s cracked it, they haven’t attempted to get into my shit. Probably because there’s nothing worthwhile to steal.
Comment on Larion Studios forum stores your passwords in unhashed plaintext.
1984@lemmy.today 11 months ago
It’s 2023, I really hope people are not using the same password in multiple places. Password managers solved this problem a decade ago. Use one. :)
Kolanaki@yiffit.net 11 months ago
mojo@lemm.ee 11 months ago
Bro that’s dumb as hell
ChaoticEntropy@feddit.uk 11 months ago
It’s cool… the password is “password123”, who would even expect that?
GBU_28@lemm.ee 11 months ago
Since 1992 I just use his creds and sign up for a bunch of shit
gornius@lemmy.world 11 months ago
“I’ve never had covid, so it doesn’t exist” vibes.
1984@lemmy.today 11 months ago
If you dont care, just give me your password then. :)
Kolanaki@yiffit.net 11 months ago
It’s *********.
Edit: I guess the site autohides passwords? 🤷🏻♂️
1984@lemmy.today 11 months ago
I tried putting the stars in there and it didn’t work!
:)
Nibodhika@lemmy.world 11 months ago
First of all they wouldn’t know there’s nothing worthwhile until they got in. But most importantly if you’re using the same password for everything since 91 there’s around a 0% chance that password hasn’t been leaked. This means that a random person can have access to everything that you have that’s not 2fa protected without you even noticing. You said that no one tried to get into your things, how would you know? Most places don’t let you know when someone login successfully, and a lot of other places do so with an email which the attacker can quickly delete.
If you really use the same password for everything since a long while back anyone who knows your email address can get into anything yours, getting a hold of one of those password dumps is really easy, especially older ones.
AssPennies@lemmy.world 11 months ago
if you’re using the same password for everything since 91 there’s around a 0% chance that password hasn’t been leaked
Plot twist, they’ve never had their password leaked due to never having a password.
They spend every last waking moment trolling through public or university libraries to find computers that people haven’t logged out of, and are still logged into social media, dialup modems, irc, bbs, mainframes, etc. It’s these accounts they make posts from.
Pretty lonely world when you only ever get to make one comment on one account at max like once a week. And then you never get to check the replies. You never get to check your email either, you don’t know if anyone has sent you and e-card for your birthday.
Oh and not to speak of constantly getting kicked out of those libraries once the librarians recognize you. To the point where you have to move to yet another city to have any online time again.
But hey, they’ve never had their password leak at least!
Kolanaki@yiffit.net 11 months ago
Hey! Stop telling people my secrets!
Nibodhika@lemmy.world 11 months ago
Like I said, almost 0%, there’s always a chance he’s the Phantom of the Library.
Kolanaki@yiffit.net 11 months ago
First of all they wouldn’t know there’s nothing worthwhile until they got in.
I mean, you can read all my comments and posts publicly, and social media is just about the only thing I’ve ever had passwords for. 🤷🏻♂️
emptyother@programming.dev 11 months ago
Oh, they are. I keep telling people to WRITE DOWN YOUR PASSWORDS, and NEVER use same password on two sites. They dont listen. Its a lot easier to just remember 1-4 variations of a password and use that than carry around a password notebook. And they think themselves safe.
I’m thinking most people shouldnt use passwords at all anymore. They are a huge point of failure because people are people. We need something else to be the norm. How can we make hardware keys or something the norm for logging in? Have everyone carry around a bankcard-like thing that fit into every computer where people need credentials. Would’nt that be safer while still being accessible and convenient?
1984@lemmy.today 11 months ago
There are yubikeys you can use to login, but it requires installing stuff on each computer you want to access. Nothing is simpler then passwords. :)
Bitrot@lemmy.sdf.org 11 months ago
FIDO2 can be used for passwordless log in on a few sites, but the site and browser need to support the feature (no extra installation). It sets a pin on the yubikey and when entered the key does all the authentication. It will likely be seen more as Apple “passkeys” gain more popularity, Windows and Android already have native support but don’t market as hard.
emptyother@programming.dev 11 months ago
Nothing is simpler than passwords. But we want something thats both simple and safe. Even for lazy people, tech-unsawy people, and people with bad memory.
What if every pc came with a jubikey-ish reader and every website supported a browser api for it? Probably not jubikey, but something that fit in a wallet like bank cards do. Wouldn’t it be both safer and simpler than passwords? It would take some time to turn around of course but the same was probably the case for https, 2fa, ipv6, and tpm’s.
Bitrot@lemmy.sdf.org 11 months ago
Those are called smart cards. Traditional smart cards needed centralized management of credentials, but FIDO2 smart cards exist that work like the keys. The reason tokens are more typically USB-based (or NFC) is every PC has USB, but most don’t have smart card readers.
Chobbes@lemmy.world 11 months ago
It would take some time to turn around of course but the same was probably the case for https, 2fa, ipv6, and tpm’s.
Oh yeah… Definitely good IPv6 support everywhere. That really turned around, and we’re not dragging our feet on implementing IPv6 at all 🥲.
Chobbes@lemmy.world 11 months ago
Oh, they are. I keep telling people to WRITE DOWN YOUR PASSWORDS, and NEVER use same password on two sites. They dont listen. Its a lot easier to just remember 1-4 variations of a password and use that than carry around a password notebook. And they think themselves safe.
Honestly, the best solution for this is a password manager and not a notebook. The average person is not going to come up with strong passwords on their own for every website. A password manager once setup can be more convenient than whatever they were doing before, so if you can get people to use one they’ll be in much better shape.
I’m thinking most people shouldnt use passwords at all anymore. They are a huge point of failure because people are people. We need something else to be the norm. How can we make hardware keys or something the norm for logging in? Have everyone carry around a bankcard-like thing that fit into every computer where people need credentials. Would’nt that be safer while still being accessible and convenient?
My understanding is that this is basically what the whole passkeys initiative is. I have sort of mixed feelings on it. Hardware tokens for logging in is great, but I worry about people stealing the hardware tokens from others. Mostly people are going to use their phones, though, which should have some other mechanism of authentication.
thisbenzingring@lemmy.sdf.org 11 months ago
suggest something like this
use your favorite password but add the site to it
so your lemmy password would be ilovemypasswordLEMMY
and your reddit password would be ilovemypasswordREDDIT
that way they can keep their shitty password but it won’t be the same password on every site and they have an easy way to remember what the proper password is for the site they want to accesss
wahming@monyet.cc 11 months ago
That’s horrible if you ever become the victim of a targeted attack. Compromise your password once on some random shitty site and they’ve got access to everything
thisbenzingring@lemmy.sdf.org 11 months ago
This will create individual passwords which is better than the same password everywhere. If it’s the least they will do, it’s better than not.
docwriter@lemmy.eco.br 11 months ago
I used to do this, but I realized that if someone got access to any of my passwords, they would easily spot the pattern.
In the end, using a password manager and generating large random passwords for each site was the best solution I found.
thisbenzingring@lemmy.sdf.org 11 months ago
Still better than using the same password. My argument is if you can only convince them to do at least that, it’s better than every site using the same password
Honytawk@lemmy.zip 11 months ago
There are people who purposely forget their passwords, so they use the “forgot my password” link every time they need to login.
Hard to hack them.
1984@lemmy.today 11 months ago
Yeah some sites also dont have passwords, they just send a login link to your email every time.
I prefer passwords so I don’t have to go to my email to log in, but I understand it’s easier for some people to do it that way. Your email address becomes your identity then.
hex@programming.dev 11 months ago
That’s just 2FA with extra steps