Nothing infuriates me more than when they ask me to reduce my 20 char alphanumeric+symbols unique password to a 4 char numeric pin for my security.
this post was submitted on 05 Oct 2026
776 points (99.2% liked)
Lemmy Shitpost
42225 readers
4691 users here now
Welcome to Lemmy Shitpost. Here you can shitpost to your hearts content.
Anything and everything goes. Memes, Jokes, Vents and Banter. Though we still have to comply with lemmy.world instance rules. So behave!
Rules:
1. Be Respectful
Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.
Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.
...
2. No Illegal Content
Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.
That means:
-No promoting violence/threats against any individuals
-No CSA content or Revenge Porn
-No sharing private/personal information (Doxxing)
...
3. No Spam
Posting the same post, no matter the intent is against the rules.
-If you have posted content, please refrain from re-posting said content within this community.
-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.
-No posting Scams/Advertisements/Phishing Links/IP Grabbers
-No Bots, Bots will be banned from the community.
...
4. No Porn/Explicit
Content
-Do not post explicit content. Lemmy.World is not the instance for NSFW content.
-Do not post Gore or Shock Content.
...
5. No Enciting Harassment,
Brigading, Doxxing or Witch Hunts
-Do not Brigade other Communities
-No calls to action against other communities/users within Lemmy or outside of Lemmy.
-No Witch Hunts against users/communities.
-No content that harasses members within or outside of the community.
...
6. NSFW should be behind NSFW tags.
-Content that is NSFW should be behind NSFW tags.
-Content that might be distressing should be kept behind NSFW tags.
...
If you see content that is a breach of the rules, please flag and report the comment and a moderator will take action where they can.
Also check out:
Partnered Communities:
1.Memes
10.LinuxMemes (Linux themed memes)
Reach out to
All communities included on the sidebar are to be made in compliance with the instance rules. Striker
founded 3 years ago
MODERATORS
My (soon to be ex) bank recently decided to make everyone use their ID card number which can be obtained from many sources and does not change, a username with symbols and numbers and minimal length requirements which cannot be changed and a 4 digit pin code. No 2FA at all, so its only saving grace is that you get locked out at 3 tries.
I'm guessing they are trying to align everything to their legacy ATM pin code system instead of making the ATM system better.
There is something about ATM system architecture that must be so ancient it ran on punch cards. In reality I'm sure it's COBOL being COBOL but there's hardly any excuse for a machine to take SO LONG to process a simple transaction.
Credit unions really are refreshing (as much as a financial institution can be, at least). Mine's utter shit, but they've still gone to unrestricted length ATM pins and options for 2FA / 3FA online access and they support FIDO2 for auth & transaction confirmation. It's ridiculous how behind the establishment banks are getting.
Let me introduce you to MyP4s$worcl*websitename**@
I still stand by xkcd 936.
Since no one can know which characters you used, you have to assume all/most. Throw one character in there to be safe, in the middle of a word.
Banks on the other hand: no you're only allowed 4 numbers!
And don't you dare use stuff like , or ç as a special character!
I like it when they ban ;
if they ban ; i'm using &. fuck yo database.
I assumed it was password1! Yours is better
It's also a gigantic red flag when sites say there's a password limit
Bitch, my password is supposed to be hashed so even if I uploaded the LOTR trilogy extended edition in 4K, it should still come out the same length as any other SHA256 hash
You shouldn’t be using SHA256 to hash passwords though.
Clearly you have undiscovered SHA256 collisions that you want to attack the website with.
I appreciate the enthusiasm but my load balancer will get sad if I let you send more than 1500 bytes.
load more comments
(12 replies)
load more comments
(6 replies)
I have 5-6 apps I log into for work that all have different password requirements and are on different expiration periods. One of them is so crazy that I have to take 3-4 spins on a password generator before I get one it will accept. We also don't have a password manager that's approved to install. So, the result of all this is that I store my passwords in onenote. Very secure. Great job everyone. At least for the less severe ones I can just put whatever number I'm tagging on the end of the usual password I use.
We had a system at one of my old companies that with each password change, you couldn't have any of the same characters that were in your last password (12 character max so it was never impossible to solve), you couldn't have the same character in the same place as any of your last 10 passwords, or the same character type (letter or number) in the same space as the last password. Also no special characters.
The end result was everyone ended up using a1a1a1a1 for the first password, then 2b2b2b2b, c3c3c3c3, 4d4d4d4d, etc. The draconian password requirements resulted in everyone using the same passwords.
You know some turd in the IT department was so proud of themselves for coming up with that too.
load more comments
(4 replies)
At work my main password has to be changed every two weeks and has insane requirements and we can only use some shit company approved password manager which I cant even install on a rooted phone. This has resulted me in just changing 1 digit every 2 weeks, 10/10 guys!
I have to do it every 3 months. I'm at [password]27! now.
load more comments
(3 replies)
Your password must be at least 10 characters long.
ERROR: INVALID PASSWORD ENTERED!!!
PASSWORD MUST NOT EXCEED 12 CHARACTERS!
Even better when it doesn't tell you and just drops the last characters.
In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.
With that being said, “In systems that accept whitespace, “Live, Laugh, Love” is considered a strong password.” is an even stronger password.
This reads like xkcd
That is a wonderful compliment. Thank you.
I love systems that accept "With that being said, "In systems that accept whitespace, "Live, Laugh, Love" is considered a strong password." is an even stronger password." as my password.
load more comments
(3 replies)
Do you want your password to be sent raw into a service to analyze your password entropy and detect common patterns, OR do you want a simple rule which can be checked client side?
You don't send full raw hashes, k-anonymity is a thing. HaveIBeenPwned just takes the first 5 of a hash and sends you back a list that you compare clientside so it never leaves as a usable password.
Analyze password entropy client-side. https://dropbox.tech/security/zxcvbn-realistic-password-strength-estimation
Fun fact: As an anti-scam measure, if you type your password in a comment, Lemmy will automatically censor it for you.
Like this:
************
Cool, right?
Requiring specific characters reduces the number of permutations. The only thing that makes a password more secure is increasing the minimum length. As the OP suggests, enforcing special characters makes most people just put a special character at the end. What you have effectively done is make the last character so easy to guess that it might as well not exist.
view more: next ›