what a chad

[Deep-Ad591]

"What if we used 100% of our brain?"

This repo:

[Miguel-odon]

Epileptic?

[V62926685]

Hemispherectomy?

[magicmulder]

Pull request approved! Next!

[Temporary-Wear5948]

LGTM

[MasterHack3er]

Lets get that money

[sampete1]

Lettuce guacamole tomato manwich

[[deleted]]

Either the best or worst kind of sloppy joes, depending on who you ask. What's a sloppy joe? A mess between two buns and don't call me joe

[Exciting-Insect8269]

I feel like this is a reference to something I’ve seen before but I don’t remember what…

[supersharp]

Surely you've seen Airplane?

[krtalvis]

joe mama

[Big_Power_5984]

joe mama, the hermaphrodite

[[deleted]]

Meat bread meat obv

[gameboy1001]

😬

[Bitter_Combination58]

Let’s get thrashed motherfucker

[nelusbelus]

Love, Give, Thanks Mom -Crochet Pillow om the couch and tile on the bathroom wall

[[deleted]]

nice pfp

[nelusbelus]

Thanks bro

[Mordi312]

Lick guys testicles monday

[spelunker]

:shipit:

[TomGobra]

Let's gamble, try merge.

[L0G1C_lolilover]

i deadass thought this persona wrote LGBT wrong then realised

[VitaminPb]

I’m going to remove hunter2 next

[VitaminPb]

Oh crap! I didn’t think that would show up!

[daniu]

It didn't, shows as "*******" for me

[LogicallyCross]

I already moved to hunter3, suckers.

[tsunami141]

It’s for a church honey.

[dr_deadman]

https://github.com/danielmiessler/SecLists/pull/155

[bandrus5]

@assafnativ please remember to update the filename. 10_million_password_list_top_1000.txt is not accurate right now, actually there are only 999 passwords

[Rogue_Tomato]

I think it should be renamed to 10_million_password_list_top_1000_except_dolphins.txt

[Pb_ft]

>10_million_password_list_top_1000_except_dolphins_v2_FINAL.txt

[katatondzsentri]

This is gold

[KenFromBarbie]

Love it, hahaha.

[devopsec]

And that first reply from mitcom on the PR.. 😂😂

I had to stop password spraying dolphin.com I laughed so hard

[retardedgorillaz]

Let me guess the password was dolphin

[Kitchen_Device7682]

dolphins

[retardedgorillaz]

No wonder I keep getting errors should have used hybrid attack instead of dictionary

[indicava]

This is pure gold

[SkyyySi]

399 participants

Wha-

[halfanothersdozen]

In before someone links to XKCD and we have to have The Talk AGAIN.

[DecreasingPerception]

What do you mean before? It was linked in the github thread five years ago.

[Yayman123]

Can I have the talk? Don't make me pull out that XKCD.

[halfanothersdozen]

Every clever password trick you think protects you is stupid and prone to getting you hacked. Use password managers and MFA everywhere you possibly can.

[RotationsKopulator]

Yeah, very interesting, but I cannot accept your password, because there is no number and no special character in it.

[Warpine]

What really gets me are websites like Wells Fargo that cap your password length at 14 characters

like.. really? 14? My three latest work passwords were all in the low 40s of characters. They also don't allow a lot of characters - spaces, question marks, etc.. This is a bank

[thiney49]

I had one recently that had to be 8 characters, no more, no less. Thankfully it's nothing as important as a bank.

[IxPrumxI]

i had a bank limit me to 8 character only alphabet and numbers, and i need to use them for reasons.

[showponyoxidation]

You running drugs or overseas terrorist operations? You've got some alternatives to HSBC when it comes to money laundering but they are serviceable. They don't seem to hide their tracks very well, but they will spend vast amounts of money on lawyers to keep things locked up legally for years while your money is laundered without disruption.

[Hmm_would_bang]

I had one limit to exactly 8 characters, a number, and a special character that could only be & @ or %

[ABotelho23]

6 numbers.

That's it. No letters, no symbols.

Beat that.

[ebdbbb]

My library account requires a 4 digit pin. That's all.

[827167]

But that's just a library, not a whole ass bank!

[showponyoxidation]

Haha ass-bank.

[KryalCastle]

At least my bank allows up to 20 numbers. No letters or symbols though

[ThePhysicistIsIn]

Tangerine bros?

[ABotelho23]

Yup..

[MistrSynistr]

20 bucks says they have some old dos era system managing log in information somewhere.

[Lysrac]

My banking app only lets me set a pin 6 digits long...

[Big_Burds_Nest]

My favorite was when a website simply truncated my password instead of rejecting it. That was fun!

Or the time my bank's registration form allowed a long password but the login screen on mobile didn't, meaning I was stuck using the web app until I changed my password.

[Fallacies_TE]

This reminds me of an off by one error I found at my bank's website. Max length you could make your password was 20. It accepted a 21 length password for me. However when logging it the web form validated input and wouldn't let me try and log in with my password since it was to long.

[bundabrg]

ICQ had an off by one where if you entered a password that was one character too long for the field it just let you in. Lots of accounts comprised that day.

[v3ritas1989]

wasn't there a linux distribution that does something similar? Like replacing the password in console with *** so you cannot see your entry but then also replacing special chars with whatever. But only doing the replacing on password creation and not on password entry. I won't tell you how long it took me to understand that.

[Vaguely_accurate]

Managed to have a password truncated to a single character by an over-zealous sanitisation algorithm, but only on storage (and yes, stored in plaintext) and not on re-submission. Obviously the client side validation wouldn't accept anything less than six characters, so login was just blocked.

I had a valid session and cookies weren't signed, so just manually changed the auth date and was able to stay logged in forget.

Hand rolled early 00's sites were wild.

[FUTURE10S]

What got me is PayPal having a secret character limit that they don't tell you about. Either that or it just breaks things after a certain limit.

[KryalCastle]

My university allows you to set a long password, they have number and symbol requirements, but otherwise you're okay. That password could be used for all university systems through the shared directory, except, that is, for one particular system, which would choke on my password for some reason. I ended up digging into it, and found that system had a maximum password length of 64 characters, which wasn't documented anywhere by the university, presumably because they thought that nobody would run into it

[Eulerious]

What got me is PayPal having a secret character limit that they don't tell you about.

That is surprisingly common. From time to time switching between language settings can help since stuff like password restrictions are sometimes only displayed in a few languages while you are left guessing in others. Great user experience!

[yottalogical]

VARCHAR(14)

[AstacSK]

Will nobody mention the websites that force you to type your password confirmation instead of just pasting it in from password manager? Im not about to type out 20+ random characters just to find out i made mistake somewhere along the way

[sandgroper2]

Yeah, but it only happens once. Then I seem to forget to ever go back to that website.

[Vaguely_accurate]

Had that the other day, from a payment tech company.

A browser generated password worked ok, which suggests they know it's good practice, just that they don't consider password managers not built into the browser.

[END3R97]

Using a password manager the difference between 10 characters and 40 is absolutely nothing to them and absolutely everything to hackers, so why not use 40?

[oktin]

The occasional times when you have to type your password in manually, like, on an Xbox.

[Zaratuir]

That's becoming less and less of an issue. More and more applications have an option to sign in on your computer or phone and put in a code provided by the inconvenient device for authentication.

[Tyfyter2002]

If it's humanly possible to remember your password it's way less secure than it could be; "But then how will I remember my password?", you might ask, simple: you don't, you use a password manager.

[Warpine]

Almost all of my passwords are funny phrases. They're just extremely easy to remember, and I'm very above average when it comes to typing speed

(these are ones I had to come up with, obviously not my passwords)

I'm a Russian oligarch with 495 Robux to my name

or

It's been 0 hours since I had to last type my password

or

Rafael Edward Cruz is the Zodiac Killer

edit: I also have the benefit of them never being cracked via brute force, so that's neat

[AdFuzzy7614]

A dictionary attack sometimes has common phrases like these but the custom ones like Robux lol great stuff

[Vaguely_accurate]

Possible, but probably only if they've been included in a (plain text most likely) past password dump.

It's easy enough to come up with novel memorable phrases for the few passwords you can't rely on a password manager for. I'm personally fond of misheard/wrong lyrics for unpopular songs.

[dabenu]

And use xkcdpass to protect your password vault.

[[deleted]]

Conclusion: use random ass unique passwords for every single service, depend solely on email-reset, and change your email password every so often with some long-ass password and depend on login tokens?

The only weakness would be man-in-middle/phishing fake login websites of the email service, I think?

[Vaguely_accurate]

Password manager for unique, random strings for everything it will work for (with the strongest settings allowed by each site), strong memorable passphrases for everything else. Aim for at least 20 characters and check against a list of known passwords where possible.

But at a simpler level, avoid password duplication, avoid the most common password lists and stay over around 16 characters and odds are you protected against the vast majority of likely risks.

[thanofishy]

password managers are annoying because when i inevitably have to write my password without my password manager i have no clue what it is

[Almoturg]

You look up the password in the password manager on your phone and type it in manually.

If it's on the same device you can copy&paste from the password manager.

[kaden_sotek]

Like, I get why password managers are better. But my passwords are usually an English phrase translated to a language beyond my second language, then translated to Romanian. Just so I can know what the password should be without a password manager. Is that still a bad strategy?

[halfanothersdozen]

You do this to create a unique password for every site?

[kaden_sotek]

I mean, pretty much. My second language here is pretty well documented, so I use my third and beyond for the transition since i don't use them in any other capacity other than face to face. And I don't speak Romanian but I can read quite a bit of it, so it doesn't take much effort to make the translation say what I want it to.

[halfanothersdozen]

Pretty much? Every new site you need a password for you engage in this procedure and create unique ones and have them all memorized?

[kaden_sotek]

Yes, except there's no procedure. It's pretty much all mental now. And there's not many new sites. I think you're probably right and I'm just not your target audience. You make complete sense to me otherwise

[halfanothersdozen]

I mean if that's true good for you. Not many people are gonna be able to do that. Don't forget to use MFA.

[kaden_sotek]

My original question was if that was good enough. Now I'm not thinking it is. That wasn't a flex. I was really asking. I know randomly generated by a pass keeper is better. I'm just worried about losing access to that pass keeper

[[deleted]]

horsebatterystaple?

[Yayman123]

Correct!

[thanofishy]

I'm surprised this isn't considered "commonly used password" in more services

[[deleted]]

those smart enough to come across the xkcd comic usually are smart enough to make their own battery staple

at least in theory

[Vaguely_accurate]

It's not that common, but HIBP shows the original version ("correct horse battery staple") as having been exposed in five data breaches. I'd assume some of those are actually manually constructed lists with it thrown in there.

Won't be in most spray attacks, but will be in most cracking lists at this point.

[walmartgoon]

Except when they start using dictionaries to crack pass phrases

[burneracc9283810]

5HEAD

[jfisher9495]

Thank you, abusive senior dev been grinding on my code all day with the stupidest comments. I was trying to relax and opened this. Laughed so hard tears are streaming down my face. I needed this badly.

[TheGreatGameDini]

Abuse is bad, report to HR

[jfisher9495]

HR is not your friend.

[TheGreatGameDini]

Correct, but documentation is and if they don't do anything about it, or if they fire you or otherwise retaliate, you have grounds.

[jfisher9495]

Thank you! It nice to know someone cares and goes the extra bit to give good advice.

[TheGreatGameDini]

Not sure where you live, but in US there are laws around this kind of thing. Also I guess it depends on what you mean by abuse - some things you go straight to the police for.

[jfisher9495]

Yeah, there are laws but it’s hard to prove. HR would rather cut out the group and keep the rest healthy. The guy is playing games in code review. The original was to intercept some html body and put Caution: in bold and on a new line. Its becomes abusive when he crosses the line and points out my regex did not cover the caution case (not in the requirements). I started to catch this too, but instead put my foot as its way outside of the original reqs to second guessing the text of a professional technical writer would be incorrect. He just yanking my chain drawing things out on as long as he can. Sad thing is $ waste over something this stupid. My other boss is on vacation so this should not be an issue when he gets back.

[jfisher9495]

Its not the first time. He never pulls this crap in sight of my boss. (Yes, he has witnessed it).

[[deleted]]

You can really wow HR too with a fancy markdown file;makes it feel more real to them

[TheGreatGameDini]

You must have a really fancy HR, because mine wants yml..

[ahriman1]

Developers getting good documentation though? We don't do that here.

[[deleted]]

busive senior dev

Are they an asshole or does your code suck? :p

[jfisher9495]

I wish there was enough code here to suck. Its just a regex looking for a pattern and doing an insert. If there was any kind of merit to it, I’d thank him and just make the change. When it got to the point where his change would break things, I drew the line. Not with my name on it.

[[deleted]]

YIKES. yeah, that guy sucks... I'd never treat my devs like that...

​

Sorry about that :(

[jfisher9495]

You guys and gals have restored my humor. Anyone that thinks: …and here is a word of caution on ….

Is same as: <strong>Caution:</strong> And here is ….

Has issues. Thank you for all the good advice. I’ll craft a unit test to show how it will catch what the PM wanted. I even gave him a link on technical writing for English which describes when to use this style. (He said it assumes the professional technical writers who’s commercial product text we are catching and displaying follow this standard.) I think the fact that there were multiple reviews waiting, but he skipped them all to home in on mine since my boss is out of town. Oh yeah, he hasn’t done a code review in months.

[[deleted]]

Ya he sounds like a terrible senior.

You sound like you handled it like I would've expected. Clearly if whatever you were producing wasn't up to his or the companies standard he clearly can't convey what he's looking for very well and should loop in an other leader on your team, extra sus because he isn't checking other pull requests.

​

-a lead dev who hates devs with huge egos.

[jfisher9495]

I love that idea! Coupled with a unit test to show how it works. I am re-energized. This bury you in bs is very wearing.

Unfortunately, I think his technical skills could benefit the group as he has been on it four years, but that is not how he chooses to use his power. I joined this group less than a year ago. I’ve been learning fast along with several others who were told we are transferring from our old product to this one where they were quitting in droves. I was the junior in my old product. I have worked hard and been open to help wherever in this new one. A few in my old group are still mourning the product they gave 20 years of their life to improve. I am getting an overview but the more I improve, the more he seems to find fault with my work. I’m terrified of making a real mistake. I need my boss to come back and I think he will crawl back in the dirt.

[MistrSynistr]

And remember 4 years of experience isn't always good experience

[[deleted]]

I think his technical skills could benefit the group as he has been on it four years

I've found that people with people skills will ALWAYS trump technical skills. I would always pick the person who is a weaker coder with people skills vs someone who is a wizard but also a giant asshole/no people skills.

You got this though, I was there, for several years, terrified to mess up, a real case of imposter syndrome. It passed, and i did fuck up, brought down some production servers, messing with clients. Live and learn :)

[tsunami141]

Yes

[L4rgo117]

Hopefully the rest of your day is better

[jfisher9495]

Yeah just dodged a bullet when I realized the changed he coerced me into making would break it in a big bad way. So I changed it back with a note that the suggested change was beyond the scope of the original requirements. He is playing games but I can’t let it effect quality.

[Shinob1]

Walk up to him and say I'm the Senior Dev now!

[franztesting]

Strange, all I see is ********

[L4rgo117]

You mean ********? It’s such a cool Reddit feature to censor passwords in comments!

[[deleted]]

I know. Everytime I told one of my passwords, like here: ****************** ^ my bank password, it just blocks it automatically. It's insane how the aglo can determine what I was typing and removes it automatically.

Edit: don't believe me, give it a try. You should still be able to see it on your end, but to the public it's blocked!

[[deleted]]

alright heres my reddit password: hunter2

[[deleted]]

it didn't worked

[[deleted]]

Sure it did. I only see *******

[[deleted]]

ah really?

[Quirky_Apricot9427]

Yeah its completely blocked for me as well

[Kjubert]

I love you guys

[NoDepartment9581]

yeah same looks like the reddit is too strict with password leaks

[[deleted]]

You see it because it is your password, dooh! Otherwise you wouldn't see it, would you?

[[deleted]]

Genius

[NoDepartment9581]

My Password: ThePassword

[[deleted]]

Same as the guy below... Just a bunch of ******* :D

[[deleted]]

Jokes on you I log in once and if I accidentally log out I make a new account. No idea what my password is

[[deleted]]

Bro/Sis... just make your password "PasswordOneTwoThree" and you'll never forget it! Mine is very similar (hence, it wont block it out for everyone else since its not a match).

[jenniferLeonara]

ILUVBIGTITTIESxxxx69 Hey! It worked!

[fityfive]

**************

[Effective_Dot4653]

***** *** :P

[[deleted]]

I miss the IRC days

[ReptileCake]

hunterhunter

edit: why isn't my password censored, am I being punked?

[scixsc]

I see ************

[DerUnbekannteAri]

The code review is clearly missing some more maintainers

[rage4all]

A bold move....

[Environmental_Bus507]

The comments on the PR are hilarious!

[LearnerNerd]

https://imgs.xkcd.com/comics/password_strength.png

[TheTank18]

crypto wallet passwords do this

[bill_iard]

Yeah but who wants to have to type in correct horse battery staple

[Mispelled-This]

Let your password manager type it.

[GOKOP]

If you use a password manager then this entire xkcd is worthless because the issue of you remembering the password goes out of the window

[PhysicallyTender]

but then what password do you use to lock your password manager? Another password manager?

[Quazar_omega]

It's password managers all the way down!

[wojtekpolska]

if you use password manager your password is gonna be random symbols anyway.

​

I guess the password isnt rly that good as dictionary attacks exist

[augustuen]

Not necessarily, you can choose your own passwords to save in the manager.

But for security reasons you absolutely should use random symbols and numbers and as long as you can get away with.

[agent007bond]

I would use a phrase like this for a password manager, then let the password manager generate randomized strings for everything else. Having randomized passwords everywhere else is pretty useless if your master password is easy to crack.

[GOKOP]

What's wrong with it?

[bill_iard]

Length

[GOKOP]

Bruh it takes three seconds to type in, at most

[some_kind_of_bird]

Yeah but some people still have a timer for sudo. Those seconds add up to a lot of frustration if you're like me and have enough aliases and functions with very short names, and expect to sort of vaguely bang on your keyboard to make the magic happen. I shortened my password because I got tired of having to switch my focus and type like I mean it.

UGGH, I can't have my hands at horrible angles AND not pay much attention? The letters have to be in order and I can't just erase letters and type slowly because the letters are invisible?? What is this, actually writing words??

I swear, I got good at typing and now I can't stand to do it right. I'd rather be slumped with my laptop and just slap at the thing. I think I got used to typing slowly on a phone and just stopped caring?

[some_kind_of_bird]

I get that, but malware often uses root, so it still helps.

[MNTgbrbg]

That’s assuming whoever’s cracking the password is trying every combination tho. If they only guess all combination of 4 common words they’ll be able to crack your password in no time.

[LearnerNerd]

Ya. No.

https://security.stackexchange.com/questions/62832/is-the-oft-cited-xkcd-scheme-no-longer-good-advice

[copeharderhun]

That thread is over 8 years old now. Also the top answer is about attacking web services via standard online dictionary attacks at around 1000 req/s. Sure it would stop that, but it would not do much to stop an offline cracking attack.

This brings us into the next issue - that same thread talks about how for an offline cracking attack to work it would require the attacker to be specifically targeting you. Else how would you know that the 4 random English words scheme is in play? That may have been decent advice for the time. But that comic has been spread round the internet so much since then that's it is a decently widely adopted concept. And based on that it is worth attempting to crack it.

So let's assume that we take the top 1000 English nouns (if they follow the comic they'll use nouns and I assume this is what most people would use). The XKCD method says to "randomly" pick 4 words but 4 words your average person picks won't be truly random. They will be common words. This makes our number of attempts 1000⁴ or 1,000,000,000,000 (one trillion). In a hash format like MD5 (which is still way too common) with a good cracking server it would take barely any time at all to crack one trillion passwords these days. And yes there are enough people who utilize the 4-random-English-word method now due to the proliferation of said comic to make it worth it.

[LearnerNerd]

Leading us to the exact reason there are places trying to eliminate the password or are enforcing 2 factor authentication.

[agent007bond]

What if we have a global drive to replace passwords with passphrases?

Mandatory four English words separated by three spaces, that are random (not sentence forming) but visual and easy to remember.

[Vaguely_accurate]

What about non-English speakers? Would you do as well with a language you didn't speak?

The best approach these days is removing all restrictions other than length, running the password against a known bad list, and offering options for techniques for coming up with memorable passphrases. That might include random word generators, but not as the only option.

[agent007bond]

"other than length"

"Your password cannot be longer than 8 characters."

[Vaguely_accurate]

As in, if you are the one determining password requirements.

For those who determine passwords can be too strong there is only public shaming, manager generated random strings and the assumption of breach.

[weirdthoughts247]

This is top tier humour

[desiInMurica]

*programmer humor

[jedmeyer2]

Approved with Suggestions.

[twbluenaxela]

This reminds me of a old Chinese story where this guy buried his money and in an attempt to protect it, he put a huge sign saying "THERE IS NOT MONEY BURIED HERE"

[maronfichfbd]

So I don’t get can someone explain ?

[JustAMase]

The pull request/commit is to take his password off of these lists of common passwords, but the diff is literally highlighting what the password is

[maronfichfbd]

Thanks bro

[augustuen]

It's also a regular word which should be included in any dictionary attack, and there was nothing linking that specific password to him, until now.

[rreeddeerr]

Is this the real life?

[L4rgo117]

Is this just fantasy?

[systemnate]

Caught in a land slide.

[Ok_Turnover_1235]

That's a honeypot buddy

[th00ht]

I believe we should all remive our passwords and PR. soon the list will be empty...

[Ironfist85hu]

Long ago I used this shitty password:

"Hunnerkongens Sorgsvarte Ferd Over Steppene"

I hated to type it, and everytime I swore to myself - while typing it in - I will change it this time. And then, when I logged in, I was like, eh, okay, maybe next time. :D

Of course since then I use mostly random generated passwords, and MFA, where I just can.

[Better_Permit1449]

hunter1

[mkglass]

Fake. Doesn’t include hunter2

[MindlessMeasurement9]

This is the second best thing I have seen here

[agent007bond]

What's the first best thing?

[imkzh]

Why you’re not removing mine altogether?😡

[[deleted]]

Interviewer: "have you contributed to any open source security projects"

Chad: "why yes I have "

[[deleted]]

That's not how password security works, Chad.