1179
Passwords (lemmy.world)
submitted 3 years ago by to c/technology@lemmy.world
240 comments fedilink hide all child comments
 

We've all been there.

you are viewing a single comment's thread
view the rest of the comments
[–] 57 points 3 years ago (4 children)

“Sorry, that password is already in use” ruins it for me. That’s not a realistic message to receive.

Maybe “Your password cannot be one you’ve used previously”.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 16 points 3 years ago (3 children)

    Should be: "your password cannot be one of your last 24 passwords"

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 6 points 3 years ago (1 child)

    Especially for those places that want your password changed every two weeks.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 3 years ago (1 child)

    If they want to play that game - the calendar date becomes part of the password. It's never the same, but you can always work it out!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 3 years ago

    Or just append a letter that increments every time you change your password, and keep a note of what the current letter is.

    Passworda
    Passwordb
    Passwordc
    ...

    When your z password expires, just wrap back around to a.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 3 years ago

    At my work they wanted better security, and made the rule of minimum 12 characters, must include all sorts of numbers, special characters, etc, no previously used password and it must be changed every month, 3 attempts then the account is locked and you have to call IT.

    The result was that people wrote their passwords on post-its on the screen, so it led to worse security overall and they had ro relax the rules.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 13 points 3 years ago (1 child)

    It follows the vein of some of the password rules and feedback reducing security itself. Like why disallow any characters or set a maximum password length in double digits? If you're storing a hash of the password, the hash function can handle arbitrary length strings filled with arbitrary characters. They run on files, so even null characters need to work. If you do one hash on the client's side and another one on the server, then all the extra computational power needed for a ridiculously long password will be done by the client's computer.

    And I bet at least one site has used the error message "that password is already in use by " before someone else in the dev team said, "hang on, what?".

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 6 points 3 years ago

    It's true, most of these rules are harmful, but also most are in common use and accepted, for some reason. I have heard of a password system that had that warning, perhaps even the account, but it was in a softwaregore screenshot context.

  • permalink
  • fedilink
  • source
  • parent