Not a true greentext but I hope I have captured the spirit of it. (First time I wrote smth like this, don’t be harsh on me. >w<)

          • RecluseRamble@lemmy.dbzer0.com
            8·
            6 months ago

            That’s just recommended to emphasize length. If your password is as long as a passphrase it’s likely more secure (harder to remember though).

            • Zachariah@lemmy.world
              7·
              6 months ago

              But if the point is to remember it, then you should use the security from length of series of 5+ random words. It’s easier to remember, write down, and type. All great characteristics of a master passphrase.

              • RecluseRamble@lemmy.dbzer0.com
                91·
                6 months ago

                I don’t disagree, sorry if it sounded like I did.

                There’s just a theoretical weakness since the base word lists are usually public knowledge and bruteforcers could (and probably already have) optimize for that.

                The advantages of a passphrase outweigh though as you mentioned. An attacker would first need your repo anyway.

        • XTL@sopuli.xyz
          4·
          6 months ago

          Also, you don’t need to write it down correctly, if you remember what’s the missing or different or fake bit. And you can write down a few decoy ones next to it. Or have it in two different places. Lots of room for obfuscation along with some good old fashioned physical security on where you store the note. And the backup note off-site, if you’re that kind of person.

          Hell, just make some extra decoy ones just for fun and practice.

      • BubbleMonkey@slrpnk.net
        4·
        6 months ago

        My strategy for this is to have a second password manager available on a couple old devices, accessed with biometrics (fingerprint in this case), and only the master password saved within it.

        I considered saving it within the main manager itself, since I have devices where I can use biometrics rather than password, but that feels like a bad idea.

        Has definitely been a life saver

      • JackbyDev@programming.devEnglish
        3·
        6 months ago

        Print out your recovery kit or master password and put it with your other documents (like birth certificate).

  • KISSmyOSFeddit@lemmy.world
    56·
    6 months ago

    why is life like this?

    Because someone else getting access to your email account nowadays is worse than losing your wallet, phone and keyring, combined.

    • halvar@lemm.ee
      282·
      6 months ago

      why is life like this?

      Because the whole thing started with anon forgeting their password, the solution for which should be complicated and secure, which it is.

      • KISSmyOSFeddit@lemmy.world
        8·
        6 months ago

        I locked myself out of my main email account once.
        I had set it up in the year 2000, when people didn’t have mobile phones, so they sent a letter to your home address before they activated it.
        In the meantime, I had moved 11 times, updated my personal info on the site a few times, but never added a phone number or recovery mail address.

        So when I called the hotline and they asked me for my address to confirm I’m me, that was a hard one to answer. But I actually got it right in the second try, which was good enough.

      • Aeri@lemmy.world
        1·
        6 months ago

        The new issue is that I don’t remember the password for DICK. I know the password to like, my password manager, on a good day.

        There are like 500 other passwords I have to sift through to sign into anything

    • I Cast Fist@programming.dev
      41·
      6 months ago

      Yet having your phone stolen, which is usually worse than that, is super easy, and if you’re being mugged, the criminal will also force you to remove the pin/lock because that takes less than a minute.

  • TootSweet@lemmy.worldEnglish
    19·
    6 months ago

    Websites need desperately to display their password creation rules on login pages. If I knew this particular site had (for some dumbass reason) a maximum password length less than the length of the password I’d otherwise use on that site or (also completely unreasonably) restricts special characters, I can more easily figure out what password I used when I signed up with fewer wrong guesses, all without sacrificing any security. (It’s not like the rules aren’t public info that anyone can get. Just don’t make me go halfway through the signup process to get that information if I’m just trying to log in.)

    • Vlyn@lemmy.zipEnglish
      101·
      6 months ago

      Use a password manager, no need to remember shit then (besides your master password). For example if you want a local solution KeePass and sync the file (I use Dropbox, it’s encrypted anyway). You can also access it on Android with the sync.

      • KISSmyOSFeddit@lemmy.world
        56·
        6 months ago

        It would also let hackers know what combinations not to try.

        I have a better proposal: If your login page has any restriction on passwords (other than being part of Unicode and a max length of 128 characters) then your site should be shut down.

        • Martineski@lemmy.dbzer0.comOPEnglish
          14·
          6 months ago

          It would also let hackers know what combinations not to try.

          You mean the exact thing they could learn by clicking on “sign up”?

  • wagesj45@kbin.run
    151·
    6 months ago

    Life is like this because its easier on the developers than having to deal with the deluge angry customers losing all their shit to scammers because they use the same 5 character password for every site on the internet.

  • NickwithaC@lemmy.worldEnglish
    102·
    6 months ago

    If you’d pirated the game you would have spent all that time playing it instead.

  • I Cast Fist@programming.dev
    92·
    6 months ago

    Write down your passwords on a piece of paper. That’s literally more secure than keeping your stuff on your computer. It still won’t stop the services from wanting to be double sure you’re you because your browser’s cookies got cleaned

    Also, reset your steam password from a browser, never from the program itself. Fucking captcha never works properly on the fucking program.

    • Mixel@feddit.de
      5·
      6 months ago

      I would argue that as long as you’re careful not to get any malware keepassXC is a lot more secure and comfortable to use than tying out the passwords one by one again. Or in general your own vault warden server

    • Martineski@lemmy.dbzer0.comOPEnglish
      3·
      6 months ago

      Nope, I shared my experience on discord in greentext format because I found the whole process funny (not hating on security) and then thought that it would be a good idea to post it on lemmy too.