LFPUxS5a2b3LWr1qt2RS

Password not strong enough.

Ye Gods! How strong do you want it to be?

Sylvia.

On Wed, 5 Jun 2024 11:19:42 +0800, Sylvia Else wrote:

> LFPUxS5a2b3LWr1qt2RS
>
> Password not strong enough.
>
> Ye Gods! How strong do you want it to be?

My guess is, the password checker demands non-alphanumeric characters in
there as well.

Which is a dumb thing to require.

Lawrence D'Oliveiro <ldo@nz.invalid> wrote in news:v3ols0$qb6k$1@dont-
email.me:

> On Wed, 5 Jun 2024 11:19:42 +0800, Sylvia Else wrote:
>
>> LFPUxS5a2b3LWr1qt2RS
>>
>> Password not strong enough.
>>
>> Ye Gods! How strong do you want it to be?
>
> My guess is, the password checker demands non-alphanumeric characters in
> there as well.
>
> Which is a dumb thing to require.

Agreed. Silly rules that don't help protect you.

Looks like a good password except that you posted it. Mine is 24 characters
long and not random if you know the pattern that made it. My wife hasn't
been able to type it in even if it is written down for her to type in.

A pharmacy site rejected a proposed long password because it contained three
characters in my email address. I just call them when something is needed.
I'd rather talk to a human anyway.

FWIW, I've yet to be hacked. I've only been online since before the
Internet.

I'm also glad to see you both still enjoying life.

On Wed, 5 Jun 2024, David LaRue wrote:

> Lawrence D'Oliveiro <ldo@nz.invalid> wrote in news:v3ols0$qb6k$1@dont-
> email.me:
>
>> On Wed, 5 Jun 2024 11:19:42 +0800, Sylvia Else wrote:
>>
>>> LFPUxS5a2b3LWr1qt2RS
>>>
>>> Password not strong enough.
>>>
>>> Ye Gods! How strong do you want it to be?
>>
>> My guess is, the password checker demands non-alphanumeric characters in
>> there as well.
>>
>> Which is a dumb thing to require.
>
> Agreed. Silly rules that don't help protect you.
>
> Looks like a good password except that you posted it. Mine is 24 characters
> long and not random if you know the pattern that made it. My wife hasn't
> been able to type it in even if it is written down for her to type in.
>
> A pharmacy site rejected a proposed long password because it contained three
> characters in my email address. I just call them when something is needed.
> I'd rather talk to a human anyway.
>
> FWIW, I've yet to be hacked. I've only been online since before the
> Internet.
>
> I'm also glad to see you both still enjoying life.
>

I read somewhere that someone thought that a good and well managed
password was way better than 2FA or 3FA since those, together with modern
password reset policies, leave too many gaps.

On 05-June-24 12:38 pm, David LaRue wrote:
> Lawrence D'Oliveiro <ldo@nz.invalid> wrote in news:v3ols0$qb6k$1@dont-
> email.me:
>
>> On Wed, 5 Jun 2024 11:19:42 +0800, Sylvia Else wrote:
>>
>>> LFPUxS5a2b3LWr1qt2RS
>>>
>>> Password not strong enough.
>>>
>>> Ye Gods! How strong do you want it to be?
>>
>> My guess is, the password checker demands non-alphanumeric characters in
>> there as well.
>>
>> Which is a dumb thing to require.
>
> Agreed. Silly rules that don't help protect you.
>
> Looks like a good password except that you posted it.

Well, I chose a new one that is equally random, but also contains the
required "strong" characters.

Sylvia.

On 05-June-24 1:38 pm, D wrote:
>
>
> On Wed, 5 Jun 2024, David LaRue wrote:
>
>> Lawrence D'Oliveiro <ldo@nz.invalid> wrote in news:v3ols0$qb6k$1@dont-
>> email.me:
>>
>>> On Wed, 5 Jun 2024 11:19:42 +0800, Sylvia Else wrote:
>>>
>>>> LFPUxS5a2b3LWr1qt2RS
>>>>
>>>> Password not strong enough.
>>>>
>>>> Ye Gods! How strong do you want it to be?
>>>
>>> My guess is, the password checker demands non-alphanumeric characters in
>>> there as well.
>>>
>>> Which is a dumb thing to require.
>>
>> Agreed.  Silly rules that don't help protect you.
>>
>> Looks like a good password except that you posted it.  Mine is 24
>> characters
>> long and not random if you know the pattern that made it.  My wife hasn't
>> been able to type it in even if it is written down for her to type in.
>>
>> A pharmacy site rejected a proposed long password because it contained
>> three
>> characters in my email address.  I just call them when something is
>> needed.
>> I'd rather talk to a human anyway.
>>
>> FWIW, I've yet to be hacked.  I've only been online since before the
>> Internet.
>>
>> I'm also glad to see you both still enjoying life.
>>
>
> I read somewhere that someone thought that a good and well managed
> password was way better than 2FA or 3FA since those, together with
> modern password reset policies, leave too many gaps.

I've tried, without success, to get password resets disabled on things
like bank account online access.

Sylvia.

In article <lca3qeFjp85U1@mid.individual.net>,
Sylvia Else <sylvia@email.invalid> wrote:
>LFPUxS5a2b3LWr1qt2RS
>
>Password not strong enough.
>
>Ye Gods! How strong do you want it to be?

KeePassXC says that password has about 108 bits of entropy. It
characterizes the password quality as "excellent."

As noted by others, it's probably some bullshit "password complexity"
requirement that you include some additional character types. I ordinarily
have KeePassXC generate passwords similar to what you were trying to use,
but with look-alike characters excluded (no I, l, 1, O, 0, etc.). With a
length of 20 or more characters, you're nearly always going to get a
stronger password than some site that requires you to choose from all
available characters...and then imposes a password-length limit. (The only
reason I can see for a length limit is that they're storing plaintext
passwords in their database, which is the textbook definition of "doing it
wrong.")

--
_/_
/ v \ Scott Alfter (remove the obvious to send mail)
(IIGS( https://alfter.us/ Top-posting!
\_^_/ >What's the most annoying thing on Usenet?

Sylvia Else <sylvia@email.invalid> wrote:
> LFPUxS5a2b3LWr1qt2RS
>
> Password not strong enough.
>
> Ye Gods! How strong do you want it to be?

That is the result of "dumb/lazy programmers". They have a single
generic "error message" when something is wrong, but several very
different "checks" for strength of the password. One of which would
appear to be that the actual issue is that there are no "punctuation"
characters and their code requires at least one "punctuation"
character.

And, naturally, there is no where on the page where you enter/change
your password that details the characters they expect to see (and those
they reject -- although rejecting *any* character in a password is a
sign of either a stupid programmer, or improper storage of the literal
password).

Try again with the commonly rejected punctuation characters ($ % ' *)
and see if they also have a rule of "no use of $" but their error
message is still "not strong enough" even though they meant "cannot
contain $".

On 05/06/2024 12:08, Sylvia Else wrote:

> I've tried, without success, to get password resets disabled on things
> like bank account online access.
>
> Sylvia.

Tried at work to get a sensible policy and I work at a big tech company
that should know better. IT monkeys are just not having it.

mm0fmf <none@invalid.com> wrote:
> On 05/06/2024 12:08, Sylvia Else wrote:
>
>> I've tried, without success, to get password resets disabled on things
>> like bank account online access.
>>
>> Sylvia.
>
> Tried at work to get a sensible policy and I work at a big tech company
> that should know better. IT monkeys are just not having it.

That is due to their CYA "checkbox security" such that their A is
covered if they follow the list of "checkboxes" and the 'silly policy'
is enshrined in the checkbox list, so they duitifully follow along in
order to CYA.

You'd need to first get the checkbox security list updated to something
sensible before the IT monkeys will do anything to change.

On 05/06/2024 21:58, Rich wrote:
> mm0fmf <none@invalid.com> wrote:
>> On 05/06/2024 12:08, Sylvia Else wrote:
>>
>>> I've tried, without success, to get password resets disabled on things
>>> like bank account online access.
>>>
>>> Sylvia.
>>
>> Tried at work to get a sensible policy and I work at a big tech company
>> that should know better. IT monkeys are just not having it.
>
> That is due to their CYA "checkbox security" such that their A is
> covered if they follow the list of "checkboxes" and the 'silly policy'
> is enshrined in the checkbox list, so they duitifully follow along in
> order to CYA.
>
> You'd need to first get the checkbox security list updated to something
> sensible before the IT monkeys will do anything to change.
>

Absolutely. But I'll be retired soon so I'll leave the battle to someone
younger :-)

Scott Alfter <scott@alfter.diespammersdie.us> wrote at 15:40 this Wednesday (GMT):
> In article <lca3qeFjp85U1@mid.individual.net>,
> Sylvia Else <sylvia@email.invalid> wrote:
>>LFPUxS5a2b3LWr1qt2RS
>>
>>Password not strong enough.
>>
>>Ye Gods! How strong do you want it to be?
>
> KeePassXC says that password has about 108 bits of entropy. It
> characterizes the password quality as "excellent."
>
> As noted by others, it's probably some bullshit "password complexity"
> requirement that you include some additional character types. I ordinarily
> have KeePassXC generate passwords similar to what you were trying to use,
> but with look-alike characters excluded (no I, l, 1, O, 0, etc.). With a
> length of 20 or more characters, you're nearly always going to get a
> stronger password than some site that requires you to choose from all
> available characters...and then imposes a password-length limit. (The only
> reason I can see for a length limit is that they're storing plaintext
> passwords in their database, which is the textbook definition of "doing it
> wrong.")

Maybe it's to prevent you from using such a long password that you
forget? Who knows.
--
user <candycane> is generated from /dev/urandom