Create a password!

fourteenwings

The guidelines for this were changed recently.

glennmagusharvey

Password must include: An uppercase character. A lowercase character. A special character. A numeric character. A minimum of 8 characters. An alphabetic character.

glennmagusharvey

At United Airlines!

Password requirements and guidelines

Must be at least 8 characters in length, with a maximum of 32 characters.
Must include at least one letter and one number.
Standard special characters (such as "!" "&" and "+") are allowed.
Password is case-sensitive.
Cannot include your email address, MileagePlus number or MileagePlus username

OK.

> password strength meter!

> p
Weak
> p@
Weak
> p@$
Weak
> p@$$
Weak
> p@$$w
Weak
> p@$$w0
Weak
> p@$$w0r
Weak
> p@$$w0rd
Medium

wat

glennmagusharvey

> Security questions
> Forced to choose a question AND an answer from the list
> "What is your favorite sea animal?"
> does not have polychaete worms

> "What is your favorite pizza topping?"
> does not have anchovies

Raydere

Your username and password must be spray-painted onto the sidewalk in front of your house, so that we can verify you with our drone surveillance technology.

Bluesy_Cowgirl

narpassword

glennmagusharvey

Password must be between 6 - 50 characters long and contain at least two of the following: uppercase, lowercase, numbers and symbols.

glennmagusharvey

cdbaby.com

> p@$$w0rd

Password strength: WEAK



Good. waitaminute

glennmagusharvey

well, actually.

cdbaby demands that you have at least one letter in your password, and also one capital letter

> P@55w0rd

Password strength: STRONG



okay, get out

glennmagusharvey

i have another candidate for the Password Strength Checker Strength Checker

the original, of course, is p@55w0rd/P@55w0rd/p@$$w0rd/P@$$w0rd

the second is !@#$%12345 or 12345!@#$%

again, how to use: enter this into a site that purports to rate your password's strength. if they say any of these passwords is a good idea, their password strength checker is a load of crap.

glennmagusharvey

how to mock security questions



What is your mother's maiden name?

Jessie! James!

What is your pet's name?

Biggest Boo

What is your favorite city?

City of Ass

What is your favorite restaurant?

WcDonald's

Who is your favorite celebrity?

Billy the Kid

What is the name of your high school?

Queenvail Girls' Academy

What city were you born in?

a city built on Rock and Roll

What hospital were you born in?

l'hopital's rule

Stormtroper

What is your favorite city?

City of Ass

This is your favourite land?

glennmagusharvey

Stormtroper wrote: »

What is your favorite city?

City of Ass

This is your favourite land?

*pays 1/2 mana, taps That Ass*

Naas_Human

glennmagusharvey wrote: »

Who is your favorite celebrity?

Billy the Kid

That reminds me that not too long ago I saw a trailer for a Billy the Kid movie from this year.

glennmagusharvey

Facebook password strength test strength test!

> p@$$w0rd
Strong

> [the actual name on the account, written in plaintext, with proper capitalization and spacing]
Strong

> the actual name on the account
(as in, the string of the letters "the actual name on the account", but not actually the actual name on the account)
> the actual name on the account, written in plaintext, with proper capitalization and spacing
(as in, the string of the letters "the actual name on the account, written in plaintext, with proper capitalization and spacing", but not actually the actual name on the account, and certainly not written with proper capitalization nor spelling)

Medium

> [an e-mail address used to log into the account]
Medium

> OOPS!!
Medium
> OOPS!!!
Medium
> OOPS!!!!
Strong

> crushcrashbinkbonk
Weak

> password
> pissword
> pissward
> pussword
> posse w
Weak
> posse wa
> posse war
> posse wart
Medium

exactly how does it even draw this line????

> confused_nick_young.png
> png.confused_nick_young.png
> png.confused_nick_young.dll
Medium

> Facebook
Medium

> Facebook password
Strong

> You suck.
Strong
> it's official: you suck.
Medium
> It's official: you suck.
Strong

I guess it's looking at character class types. Add a capital and suddenly it becomes better.

Stormtroper

As I understand it, that's how it often works, some factor based what "kind" of password it is (no caps, whole words, etc.) times its length (characters/words).



After all, if it's not a given that the first character is not capitalized (and not a number/symbol), that's twice as many possible passwords to guess from.

glennmagusharvey

It's tax filing season in the United States!

Let's do our taxes using Intuit TurboTax, one of the tax filing companies that probably exists because they keep lobbying Congress to not make the IRS make tax filing any easier so they keep on getting to make middleman money.

Whoops, we forgot our Intuit password, or we need to create a new account. The password must:

Use 8 or more characters
Use upper and lower case letters (e.g. Aa)
Use a number (e.g. 1234)
Use a symbol (e.g. !@#$)
No spaces allowed [this last condition only appears if you type a space]

Guess how many of these passwords are evaluated as "STRONG"?

P@SSw0rd
P@55w0rd
Password1234!@#$
Aa1234!@#$
Useanumber(e.g.1234)
MyIntuitPassword1234!@#$
1234qwer!@#$QWER
asdfASDF1234!@#$
11!!qqQQ

Made your guess? Don't give a crap?

Well, the answer is, all of them.



What even is the point of your password strength meter? It automatically evaluates ANY nonsense fulfilling all the criteria as STRONG.

glennmagusharvey

Creating an account on Uplay to take advantage of the free Child of Light and Rayman Legends that they're offering right now? Create a password!

Should be between 8 and 16 characters in length and contain both letters and numbers.

passw0rd - mediocre
p@ssw0rd - mediocre
pa55w0rd - mediocre
P@ssw0rd - pretty good
P@ssw0rdP@ssw0rd - great!
ThisismyPassw0rd - pretty good
ThisismyP@55w0rd - great!
MyUplayP@55word - great!
asdf1234 - mediocre
asdf1234ASDF - pretty good
asdf1234ASDF!@#$ - great!
qwerqwer12341234 - pretty good
1234qwer!@#$QWER - great!
!!QQ11qq - pretty good
@QQWW1122 - pretty good
@QQWW1122qqww - as soon as I type that first lowercase q, it starts saying the password is great.

This password strength meter isn't too bad; it doesn't outright tell me that "p@ssw0rd" is a great idea. Also, to its credit, it does this:

[the login name for the account] - not allowed.

However, the strength meter is very strongly dependent on password length and presence of special characters. If I input a password consisting of mashing the keyboard to get 16 random letters and numbers (even if I have a space somewhere) it only goes up to "pretty good". Here's some testing:

p98we4rluj4orjoj - pretty good
p98we4rluj4SLIJE - pretty good
p98we4rl - mediocre
p98we4rlPOIJWERJ - pretty good
p98we4rlPOIJWER# - great!
aaaa1111AAAA!!!! - great!
aa11AA!! - pretty good
apwoieja;oidsjf0 - pretty good
":Loieja;oidsjf0 - pretty good
&^Loieja;oidsjf0 - great!
!!aa11AA!!aa - pretty good
!!aa11AA!!aa1 - great!
!!aa11AAAAAA - pretty good (12 characters)
!!aa11AAAAAAA - great!
!!aa11AAAAAAAA - great!
!!aa11AAAAAAAAA - great!
!!aa11AAAAAAAAAA - great!
!!aa11aaaaaaaaaaaa - pretty good (16 characters)

Yeah, it's just so blatantly length-depedent and character-set-dependent. As long as you have at least two symbols, at least all four character groups represented (top row symbols, numbers, lowercase, and uppercase are represented, and at least 13 slots are filled, you get a top marks.

The only oddity so far is that apparently non-top-row symbols don't count as symbols:

!!aa11AAAAAAAAAA - great!
[[aa11AAAAAAAAAA - pretty good
;;aa11AAAAAAAAAA - pretty good

glennmagusharvey

oh bonus find

Password1234!@#$ - great!

fourteenwings

Firefox can now generate hyper-random passwords and save them immediately.

I want to trust this but I really can't.

glennmagusharvey

Generating random passwords is easy. If I'm fine with pseudo-randomness I can just smash the keyboard, with or without Shift depressed as applicable. Normally this is all that'd be needed anyway.

I'm not sure why I'd trust the browser to save my passwords for me. To be fair, the browser already does read my passwords. But still, one less thing that could be attacked. I can't defend against a malicious browser itself, but at least I can defend to some extent against a negligible browser.

fourteenwings

Firefox now has access to my computer's general login credentials (to use for verification for other things).

I did not consent to this or even know about it until I absolutely had to.

Thanks, auto-updates.

glennmagusharvey

Stormtroper

I manager to wild-guess a nearby Wi-Fi network's (easy) password at work, on the first try even. I insta-felt guilty about it and disconnected after double-checking that it worked. Also I'll be moving off that workplace so chances are it won't come up again.

glennmagusharvey

oh hey, this one is working correctly!