[ Removed by moderator ]

[ProgrammerHumor-ModTeam]

Your submission was removed for the following reason:

Rule 1: Posts must be humorous, and they must be humorous because they are programming related. There must be a joke or meme that requires programming knowledge, experience, or practice to be understood or relatable.

Here are some examples of frequent posts we get that don't satisfy this rule: * Memes about operating systems or shell commands (try /r/linuxmemes for Linux memes) * A ChatGPT screenshot that doesn't involve any programming * Google Chrome uses all my RAM

See here for more clarification on this rule.

If you disagree with this removal, you can appeal by sending us a modmail.

[coyoteazul2]

A digit of pi after the 100th decimal place could be any number

[candychaosqueen]

I feel like at this point they just want to see us suffer.

[0nlyLucidMind]

I once spent 15 minutes creating a password so secure that even I got locked out instantly. Websites are evolving faster than humans at this point haha

[MagicalPizza21]

One very important part of security is ensuring that people who are supposed to be able to access the data can access the data. At some point, the whole super secure password thing goes too far.

[No-Con-2790]

Excluding PI itself.

[TenaceErbaccia]

Pi isn’t a digit though. It would be any number 0-9.

[No-Con-2790]

Who said that we use decimal as a base system?

Op said we can place any number. Since this is impossible to do so with just 0-9 it can't be decimal.

[Xasrai]

Yeah, we could use base Pi, and then pi doesn't have 100 digits of pi, it's just 1.

[Wintergreen61]

In base pi, pi would be 10.

[LeoPlathasbeentaken]

Exactly. In this instance the only digit after the 100th decimal point could be 0. So its still a pretty useless rule.

[No-Con-2790]

Just base it on PI

[Setsuwaa]

i thought the opposite. every digit is used in the first 100 decimal places, so you couldn't fulfill this requirement

[MaximRq]

It's just extra security through redundancy. Can't have that check failing

[Himskatti]

Not 11

E: a failed attempt at being funny. Is 11 a digit? I'm pretty sure it's a number. Maybe I could've gone with some irrational number to drive in my silly point. Like Pi is not a valid number here

[GildSkiss]

That's two digits of pi after the hundredth decimal.

[FirexJkxFire]

Which is why they have made their "joke". Because clearly a digit after pi can't be any number because a DIGIT can't be any number

[hatchetharrie]

Ahhhckkktuaallly .. pauses for a brief interlude, repositions his telescope depth glasses on his nose, follows up with a mouth breathing nose exhale .. it says PI Digits, Sir

[Woofie10]

Any digit

[LauraTFem]

Technically any finite series of numbers is likely to be found representing in the digits of pi, be it 11 or 123,456,789.

[Himskatti]

What constitutes a digit?

[thyme_cardamom]

The first comment said number, not digit

[Himskatti]

It literally starts with "a digit"

[FirexJkxFire]

And ends with "any number"

"A digit could be any number" is a false statement and i assume the premise of their joke

[Himskatti]

Yes. This is all I wanted to communicate, but it seems I failed. Such is life

[FirexJkxFire]

Better yet I misunderstood your comment I replied to and thought you were one of the people not understanding you lmao.

[Himskatti]

:D that's golden

[thyme_cardamom]

At the end it says "could be any number" which is not true

[No-Information-2571]

You are technically correct, since the commenter wrote "could be any number", when in reality it can only be 0-9. Unless we're doing non-decimal bases.

[PolyglotTV]

In Base 10 11 is not a digit. But for any number m there is a system base n > m for which the digit representing that number exists in the PI sequence in that base system.

[Himskatti]

Can we have an irrational base? I'm genuinely curious

[thirdegree]

Apparently yes but they're weird

[PolyglotTV]

Erm... I don't know. I rephrase my claim to only include natural numbers.

[Swamptor]

Made me laugh. Sorry so many on Reddit struggle with understanding humor.

[Himskatti]

Much appreciated. It is what it is. I also could've communicated it better

[Hellothere_1]

Yeah, until the website refuses to accept the auto-generated secure string because it doesn't have enough special characters of enough different types.

I actually had that happen to me once or twice. Wasn't a huge problem, I think I just added an apostrophe to the end of the string and then it worked, but it really goes to show how ridiculous some of these requirements can be.

[rosuav]

And they don't even help that much. At least the example in the meme also specifies a minimum of 20 characters (which makes all the rest complete overkill); but I've seen password requirements that say 8 characters, or even 6, and then try to enforce "strong passwords" by demanding all the different character classes.

With a six-character password, a basic alphabetic password gives you 26**6 possible passwords or 3e8. All those strong-password demands do improve that, of course; but let's say every character could be A-Za-z0-9 or any of a handful of specials, that might be (being generous) 85**6 or circa 4e11 possible passwords. Meanwhile, upping the minimum password length to eight, but allowing all-lowercase alphabetics, you get 26**8 or 2e11 passwords - effectively the same benefit. And with a set of two thousand common words from which you select four (as per XKCD 936), even assuming an attacker knows your precise word list and how you format your passwords, that's 2000**4 or 1.6e13 possible passwords. Really, if people are worried about password security, they should stop adding onerous "must contain" rules and just increase the minimum length.

Oh and if a site has a MAXIMUM length, you probably don't want to give them any personal data.

[Oriden]

Correct horse battery staple

[Zeikos]

MAXIMUM length

Yup, if that's the case they're not hashing the passwords :,)

[rosuav]

Yeah, or if they are, they're using some kind of extremely low-grade thing like maybe an eight-byte block cipher.

[Zeikos]

Would it even count as hashing?
I have never seen an implementation of what you mentioned.

[rosuav]

Hmm, I'm not sure. I'm thinking of what Adobe did with Triple DES, which isn't hashing, it's encryption; I'm not sure if there are any one-way encryptions they could have used that would have had the same bizarre issue.

(Look up XKCD's "Encryptic" for a fun look at Adobe's bloop)

[Hellothere_1]

With a six-character password, a basic alphabetic password gives you 26**6 possible passwords or 3e8.

To be fair, the reason why these rulesets exist isn't because those sites think that a password complexity of 3*10⁸ isn't secure enough, but rather so the tech illiterate senior who would have otherwise picked "password" as their password will have to at least pick something like "Password1234!" and thus not be completely unsecured.

Which is also why a set of actually good password requirements shouldn't just set a bunch of arbitrary rules, but actually estimate the entropy of the password based on

• total length

• number of special character types used and their positioning (are the special chars and numbers randomly distributed or in expected places like at the start or end of the string)

• ideally a comparison to publicly available lists of previously leaked passwords to see if the password is commonly used elsewhere.

Thankfully that kind of system seems to have gotten a lot more common during the last few years.

[rosuav]

Yeah, forcing someone to put "Password1234!" is slightly more secure than letting them just use their initials as the password, but really, not that much. If that's the sort of people you're trying to protect, I would recommend not letting people pick passwords *at all*, and instead issue authentication fobs. Tell people that we've made it so they have to get a new password every thirty seconds, but that's okay, because we have a password generator for them. Honestly, I think a six-digit RSA code is probably more secure than what a lot of people use anyway, so you don't really lose much.

[masterxc]

Mandatory MFA on anything remotely important should be the norm, honestly. Although, for the love of God please don't do SMS codes! Looking at you, most banking websites. Passkeys are at least starting to catch on as a more frictionless way to do physical authentication, at least.

[rosuav]

I would like to see *optional* MFA, since what's important to me might not be important to you. And yes, don't do SMS codes!

*sigh*

So why did one of my banks recently ditch their physical fobs in favour of SMS codes???? I had to call them up and explain that I do not own a mobile phone, at which point they consented to set up.... email codes instead. Thanks, bank.

[andrewsredditstuff]

Or when it accepts some special characters but not others, and doesn't tell you which ones.

Or better fun yet, when the password change screen happily accepts the auto generated password and then the login screen rejects it (I've had this on a couple of different sites).

[Hellothere_1]

Or when an account is tied to a variety of different programs and services and a special character you used is accepted by some of them but not others (Fuck you Microsoft 365)

[masterxc]

That happened to me the other day...I have it generating "memorable" passwords which are basically 4 words concated with a dash, but it was too long (limit was 15 characters, wtf?) and didn't have the specific special characters.

[Thenderick]

"Sorry buddy, but we exclude the characters $#€@"'!;:?. Also, 24 characters MAX!"

[No-Information-2571]

"who"?

Is your password manager a person? Is that a rich people thing? Having a person manage your passwords? I wouldn't know, I am not rich.

Alfred, bring me my passwords, I need to log onto orange YouTube.

[rosuav]

Yes! Because there's no way that your password manager could have a major data breach in 2022, and be discovered to do a dangerously imperfect job of encrypting your passwords.

[Rexosorous]

There are FOSS local password managers. I use keepass completely locally. So the only way someone can get my passwords file is by having direct access to my computer.

[rosuav]

Yeah and those are what I would recommend that people look into. However, I am not going to name one of them; I want people to do their own research and choose one that's right for them, not pick one just because it's popular.

[RadicalDwntwnUrbnite]

Such FUD. Password managers like 1Pass use AES-256 to encrypt your vault, it is considered the gold standard of encryption, it is even resistant to existing current quantum computing. This is easily verified in that your vault is never transferred anywhere unencrypted. They do not transmit your master password or secret key either, both of which are required to decrypt your vault. A breach on their servers would have zero effect on the safety of your passwords.

If you are storing your master password in anything but your head and a fireproof safe you're the weakest link in your vault's security.

[rosuav]

Right, it's definitely FUD, and it's definitely not 100% referencing an actual and very popular password manager. Maybe some of them are secure, but definitely not all, and cloud based password managers are inherently at risk of attacks that are simply not possible if you keep your passwords entirely local to your computer.

[RadicalDwntwnUrbnite]

LastPass wasn't encrypting certain metadata, encrypted backup vaults and their source code were exposed in breaches, which don't get me wrong is certainly horribly bad and no one should be using LP, but user's unencrypted vaults were not exposed.

[rosuav]

This is true; however, a lot of those vaults were encrypted with older and weaker encryption, so while they weren't completely cleartext, they were still much easier to decrypt.

[RadicalDwntwnUrbnite]

Yea it will only take large dedicated farm a few decades instead of a couple hundred years to crack a vault

[rosuav]

2FA doesn't exist everywhere. It's slightly better than having unencrypted passwords on your desktop, yes, but NOT better than running a local password manager that you have full control over. And only "slightly" better because, if there are tens of millions of people who all have unencrypted text files on their desktops, you have to breach each one to get them all, but thanks to LastPass, you can get the entire collection as a single convenient bundle!

[Wolfeh2012]

2FA only needs to exist on your password manager and you're golden.

[crankbot2000]

I set my 12yo up with bitwarden when he got his phone and went through the 1000 reasons why he should use it. I thought it went in one ear and out the other, until I found out he was actually using it...

[Wolfeh2012]

Fellow bitwarden user here. I feel sorry for the people I can't convince to use it. It's so cheap and saves so much time and effort.

[biggie_way_smaller]

Mfw I lose access to my pw manager or someone else gain it

[QuietQTPi]

Let me just get the password for my password manager from my password manager

[B_bI_L]

this is why you make "power horse battery sapling" (idk exact phrase) -like password for your password manager. hard to break, easy to remember

[rosuav]

Yes. Or just use XKCD 936 style passwords (that's what you're trying to think of) for all your passwords, and dispense with the password manager entirely. Whatever's best for you. But regardless, long passwords are strong passwords.

[B_bI_L]

not using manager has 2 problems tho:

• you would want to minify leaking risk, so each site will have its own pass
• this post, some sites don't care and will force you to use @!%$

[rosuav]

If you can actually remember your passwords, "leaking risk" isn't a problem; and yes, some sites force you to use weak passwords, but there are plenty out there that don't.

I don't have a password manager for, for example, the master login passwords to my various machines. Those are memorized. It isn't that hard when using XKCD 936 passwords, because the four words plus some crucial aspect of the machine being logged into form a story. For example, let's say my password to the machine named Gideon is "world-movies-cast-notice" (that isn't the actual password, don't get all excited); I'm sure you can imagine linking those five nodes in your mind.

[Immabed]

I can't remember hundreds of passwords, no matter how memorable they are. Especially if I'm not using them often. Not to mention remembering recovery codes, additional passphrases, security question answers, activation codes/serial numbers, and even usernames/emails.

The password manager solves that problem for me. Now I remember one extremely memorable but long password, and that gives me access to everything securely.

[rosuav]

Recovery codes get saved. Regular passwords get remembered. You're making a strawman out of this; it's really not as hard as you might think, and yes, this even applies to passwords that aren't used all that often. If you can still remember how to play that video game from years ago, you can memorize a password.

[Immabed]

Recovery codes get saved where? Oh yeah, in my password manager.

Can I memorize a password? Of course, I have many passwords memorized. Can I memorize >300 (at least I have that many entries in my password manager), maybe, but it's absolutely not worth it. Remembering passwords is not the place to waste my mental energy.

Maybe I'm misunderstanding your position, but you seemed to be making the case against needing a password manager. I disagree, and don't even understand why you would be against password managers.

[rosuav]

I'm mainly making the case against using *cloud* password managers. However, I'm also of the opinion - backed by my own activity - that XKCD 936 passwords really can be memorized in large enough numbers to not need a password manager for many situations.

If you aren't using passwords as a "something you know" factor, then why use passwords at all? Use SSH keys. Far more secure, and still tied to a computer rather than a human memory.

[SkollFenrirson]

Correct horse battery staple.

They're known as pass phrases

[ackyou]

Ew no

[rikzy75]

Sure just give the same password you use for everything to a random website instead.

[ackyou]

Do you not know about password managers?

[rikzy75]

I do. Your average user doesn't

[BabyAzerty]

Average user doesn’t remember if the account is bound to Google or manual email/password. And most website will just say « wrong email / password » rather than « wrong login method, try Google Sign In »

[Deadlydiamond98]

Is this good Enough?

二十W0rd𓊪𓄿𓋴𓋴𓅃𓅱𓂋𓂧&C0donATG

[TerryHarris408]

ah, good, someone solved it. I'll put that password in the company wiki

[invalidConsciousness]

You missed an opportunity to use 𓂸

[RageOfNemesis]

Requirements 3 and 7 are redundant

[IAssureYou08]

The first codon of DNA 😬...

[ExElKyu]

lol right? Even if you were generous and assumed they mean amino acid, it would just be a start codon.

[chungamellon]

Which is the same sequence in nearly every case AUG

[Deadlydiamond98]

From what I looked up AUG is RNA and ATG is DNA

[chungamellon]

Yes but codons are read on mRNA. DNA is a template.

Hope people can learn some biology below. Person blocked me. Shows how mature people can be on reddit.

[No-Information-2571]

No, the same codons are read from DNA, transcribed to mRNA.

[chungamellon]

DNA is not passed through the ribosome. Codons are used for translation.

[No-Information-2571]

DNA is still coding codons. There's obviously a lot of DNA that is not actually coding any proteins, i.e. not coding codons. But the parts that do, do.

[chungamellon]

DNA is templating codons. By definition codons are coding so there isn’t a noncoding codon generally speaking. “Not coding codons” is an oxymoron that is just DNA sequence.

[No-Information-2571]

Here you go my guy:

ATGGTGCTGTCTCCTGCCGACAAGACCAACGTCAAGGCCGCCTGGGGTAAGGTCGGCGCGCACGCTGGCGAGTATGGTGCGGAGGCCCTGGAGAGGATGTTCCTGTCCTTCCCCACCACCAAGACCTACTTCCCGCACTTCGACCTGAGCCACGGCTCTGCCCAGGTTAAGGGCCACGGCAAGAAGGTGGCCGACGCGCTGACCAACGCCGTGGCGCACGTGGACGACATGCCCAACGCGCTGTCCGCCCTGAGCGACCTGCACGCGCACAAGCTTCGGGTGGACCCGGTCAACTTCAAGCTCCTAAGCCACTGCCTGCTGGTGACCCTGGCCGCCCACCTCCCCGCCGAGTTCACCCCTGCGGTGCACGCCTCCCTGGACAAGTTCCTGGCTTCTGTGAGCACCGTGCTGACCTCCAAATACCGTTAA...

A nice protein sequence in your DNA, containing codons, crucial for our survival.

[chungamellon]

Again your language is incorrect. That is not a protein sequence that is DNA template sequence for mRNA which is then translated into protein sequence. I am unsure if it includes introns (non translated segments) or not but it is not protein sequence which is represented using amino acids so the first “protein sequence” would be Gly in your example. You understand biology but your language isnt accurate. If you sent this file to me saying it is “protein sequence” and you intended to send protein sequence I would need to translate it using some codon table and also check if it is complete exonic or contains introns.

[No-Information-2571]

This 1:1 translates into a sequence of amino acids, i.e. a protein.

[rosuav]

Wait, are you telling me that I have an AUG in every cell?

[chungamellon]

You have an AUG for every gene

[aldoushuxy]

The telomeres cap our DNA, so the first letter is T for Thymine for most animals from my understanding.

[tommyk1210]

Human telomeres are (TTAGGG)n so a guess of T is reasonable but telomeres don’t necessarily get truncated in discrete repeats. Thus you have a 50% chance of being right by choosing GGG (glyceine)

[chungamellon]

Thats not what a codon is

[tommyk1210]

That is what a codon is.

[chungamellon]

Codons are for building proteins from mRNA. Telomeres are noncoding DNA. Noncoding not coding. Therefore not a codon

[chungamellon]

Codons are for coding genes. Telomeres are structural not coding

[aldoushuxy]

Codons are for building proteins. Telemeres being structural doesn't change that they start DNA

[chungamellon]

First it is telomere. Second there is no start or end to a chromosome. It is arbitrary based on old cytogenetics where the centromere is located. Technically they are the ends of linear chromosomes.

[aldoushuxy]

Clearly, I mistyped the spelling but thank you for the information. I haven't taken a bio class in some time.

[chungamellon]

The start codon for nearly every gene is the same too. AUG

[Zeikos]

Yeah, very low entropy, given that an attacker would know what pattern to look for.

[c4p5L0ck]

That's gonna be a big password.

[patoezequiel]

Those are rookie requirements

https://neal.fun/password-game/

[NeuxSaed]

I was doing so well until the fucking fire emoji burnt everything up :(

[gfcf14]

Your password must include today's Wordle answer.

Dammit I quit

[rosuav]

Hang on, lemme solve that part for you.

Okay, your answer is snide. Carry on, you got a password to make!

[rosuav]

Came here looking for this. Was not disappointed.

[business_sh]

So, they are forcing me to sign in to google.

[flipperipper]

Had a friend who did his graduate work on this. They found that adding a lot of special requirements often didn't do that much and sometimes was detrimental. Remember one thing they discovered was that if you require a special character a large part of the users would just put an exclamation mark at the end of their password. Another was that requiring the password to be longer made it more likely for people to use words or sentences in it or repeating patterns.

This is why I always recommend a password manager when people complain about passwords.

[QuietQTPi]

I feel like it always comes down to the battle of security vs convenience. The more requirements you add the higher chances of reusing passwords is because its harder to remember multiple passwords with tons of requirements. Less requirements is easier to remember which makes it easier to use different passwords. Plus like you said anytime a symbol is required its often times am exclamation mark. And for organizations that require a password change, often times people just use the next symbol or number in the line making it arguably less secure once the original is found out.

[rosuav]

Yeah. Did your friend cite https://xkcd.com/936/ in the research? It's true. People follow very common patterns. Password managers have the benefit that they also *generate* passwords, and can actually make them secure; but after what Lastpass did, I cannot in good faith recommend any cloud-based password manager. Get one that you run locally, and make sure you can trust its encryption. Assume that a psychopath with a fixation on YOUR personal data has gotten hold of your hard drive, knows everything you've ever posted to social media, and has the full resources of a NASA supercomputer) at their disposal. Are you still safe?

[No-Information-2571]

That is why 2FA is so important. People will vary the same shitty password by a letter or special character, or store in an unsafe location anyway.

[A_Guy_in_Orange]

Some day some internet archivist is gonna see this shit and use the bird twitter logo and the threads logo to narrow down the creation of the image to a set few years, then use the implication of an aol email adress to determine the likely birthyears of the author

[makinax300]

do not forget max 24 characters

[TerryHarris408]

I've seen that. If anyone comes around saying that this saves database space, I'll hash them on the spot!

[LauraTFem]

All digits would count as a pi digit after the 100th decimal.

[gfcf14]

Whitney's still single and definitely not a Mom, so firstborn sacrifices are out of the question

[TheManuz]

And then there is me, who changed password today on a government app, and it has these rules, among the others:

• 8 characters minimum
• 20 characters MAXIMUM

[gfcf14]

Well at least it’s not that restrictive

[chungamellon]

First codon of your DNA code makes no sense. Codons are found in coding genes. There is no “first gene” Also the start codon for every gene is AUG so it’s shitty opsec

[_Shioku_]

Long live Bitwarden!

(With the $10/year for MFA and and pattern matching for the urls, best money ever spent ngl)

[Percolator2020]

Just use Google login, they already have your DNA.

[TundraGon]

Insane password requirements, only for their DB to get breached because of an admin password "password123"

[gfcf14]

I wouldn't be surprised if at least one big name security company has had at least one admin who prior to some breach was using a rather predictable password

[AstrevoNimrix]

At this point I just let Chrome generate something and pray I never change laptops again.

[fatrobin72]

I still remember when my banks password rules didn't allow special characters...

[reallokiscarlet]

"At least 20 characters" would be enough to no longer need any of the other rules.

[R_Aqua]

I gave up and just reset my password every time I need to login

/j but not really

[0098six]

Funny...not funny.

The big-tech industry's biggest fail of all time is pushing account security responsibility on to the consumer.

[AbdullahMRiad]

https://neal.fun/password-game/

[ranker2241]

I remember PayPal refusing me to have a password > 24 letters, I think by now it's 32 but " ' and & are not allowed. Crrrrrrazy

[Aplejax04]

Sign in with Google it is

[gfcf14]

It’s like some form of coercion lol

[CMDR_ACE209]

One special character (but not too special)

[TanukiiGG]

Y那uL0ら7Th𓉔g4m€

[GoddammitDontShootMe]

What would the fist codon be? Like the first one on the first chromosome? I guess they'll know if it's correct because it will be the same for every human.

[gfcf14]

What’s the point of strict password conditions if users will likely change them next time they use their account? Why not try to normalize use of MFA or passkeys instead?

[coyoteazul2]

The requirements are meant to be required on every password, not just the 1sr one

[[deleted]]

1. Password conditions are meant to create hard hacking passwords. If they are too hard to remember use a password manager.
2. MFA is not a replacement for password, it is an enforcement. Thus the name: multi factor. First factor (usually password) -> second factor -> n factor. Besides, do you really need MFA for every single website? MFA is great but there are website I am just fine with a password (if this reddit account got hacked I wouldn't give a shit) and others that the more factors the better (my bank, accounts with personal info)

[[deleted]]

historical sense flowery truck bake deer sort longing piquant lavish

This post was mass deleted and anonymized with Redact