391–397 of 397 posts
Earlier quoted context omitted.
Noticed the other day BCrypt has a max input size of 72 bytes.
Ah ofcourse. My bad. I was thinking about other restrictions like usernames. For passwords there should not be any.
Earlier quoted context omitted.
With how ubiquitous Apple is, introducing a small limitation to prevent user error can make a huge difference in reducing support requests.
We all know how great a company Apple is(sigh), but even they make mistakes. Stop defending stupidity just because it's Apple being stupid this time.
I'm no fan of oversimplification, but Apple's audience is everyone, not just power users. In that case, I'd prefer having advanced options surfaced to me as "advanced" so I can do what I want, but leave the simple experiences for the simple folk.
Earlier quoted context omitted.
Ironically, apple.com itself is listed in this repository! Apparently they don't allow non-ASCII characters in passwords.
Jesus holy Apple pie! ASCII only in 2023 seems positivity antique. And this from a supposed tech frontrunner! Wth...
UTF-8? UTF-16? Others?
But that’s not the worst thing…
What about normalization? Skip or implement? Should “equivalent” code points cause differing hashes?
Should one be able to use the same password from systems with differing locales/languages ?
ASCII is insufficient, but Unicode is a royal mess!
I use Hammerspoon for Mac, have a shortcut set up for Cmd+Shift+V to actually type the letters rather than use the paste function. Works every time someone pulls this stunt. > hs.hotkey.bind({"cmd", "shift"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)
Thank you. I added this myself, but with option instead of shift (because cmd+shift+v already does "paste without formatting" iirc) like so: -- https://news.ycombinator.com/item?id=39640745 hs.hotkey.bind({"cmd", "alt"}, "V", function() hs.eventtap.keyStrokes(hs.pasteboard.getContents()) end)
On one banking website (https://yesonline.yesbank.co.in/) that blocks pasting, even if I enable paste, pasted passwords don't work whereas typed passwords do.
I welcome this extension as I, too, hate when sites prevent me from pasting (eg. to confirm my account and routing number, email address, etc). It fucks with my password manager and of course it's annoying when intricate password rules are implemented to counter the use of weak passwords. BUT. Yeah there's always a but. But. I have implemented these exact security measures into web applications. I've been handed the…
You know that if paste-blocking countermeasures get too popular then the same sites will just implement virtual keyboards. But I guess if that is to easy for folks with touchscreens then next will be the virtual mouse to click the virtual keyboard. Maybe add a randomly changing acceleration factor to the mouse to tell human and computer apart.
Considering we've had password managers for ~20 years and most people have no idea they exist, you'll forgive me if I'm not concerned about paste-blocking taking off in popularity.
Earlier quoted context omitted.
Try setting up your Linux desktop/laptop with a Cyrillic language keyboard only, and then try typing in your ASCII login password.
Aren't those keyboards usually readily switchable with a standard US keyboard layout (e.g., in Windows, MacOS, or Linux)? Do you have any direct experience with this? My point is that 7-bit ASCII underlies virtually all other keyboard / character encodings. Among the few cases where it doesn't (e.g., IBM mainframe EBCDIC, independent of ASCII), the principle encoding remains the Latin alphabet, and can readily be con…
I get your point, I am just saying that it is not universally true, even if my example is a stretched one (Cyrillic keyboard users always configure Latin-based layouts too, but it's not a default, and it's easy to forget esp if you install from a fully live env configured with both).
If it's still not clear, you can end up on a login screen with an ASCII password you can't type in, especially so without the GUI.
Earlier quoted context omitted.
I'll add to that systems that require particular characters to be used, like "must use capital, number and special character". I prefer to generate longer passwords but using only regular characters because I find it easier to type on the occasions I do have to do that. Even worse, there are some that restrict what kind of special character you can use. So even when I've generated one I still have to edit to remove o…
Obligatory: https://xkcd.com/936/ (Those of us who know, already know. I'd like to say that we all know here. But if a reader does not recognize "correct horse battery staple", then you're obliged to click the above link -- you're one of today's lucky 10,000![1]) 1: https://xkcd.com/1053/