Some password advice from an infosec professional:

Good password hygiene means choosing a password that is hard to guess.

One that's hard to type. Hard to remember. Hard to think about. Hard to LOOK at.

A password that makes you feel disoriented, uncomfortable.

In short, your password should be a Cthulhu.

#passwords #PasswordHygeine #InfoSec

The very real difference, for me, between #Mastodon and #Twitter:

I found this joke in my Twitter archive. I posted it in 2020, and as I recall it got a couple retweets and a couple likes. No big deal.

I reposted it last night here, and it already has 147 boosts and 230 likes, plus tons of comments.

#TheAlgorithm did me no favors.

@maxleibman

Well I've got most of that but those last parts like uh just figuratively yeah?

@maxleibman Incorrect, your password should be C1hu!hu
@maxleibman I usually try to include either the Shoggoth emoji, or U+1f7d3 ELDRITCH GEOMETRY STRANGE ANGLE
@maxleibman I lose one point of SAN every time I type my master password.

@maxleibman this is terrible advice!

It shouldn't be hard to type, it should be impossible to type! A good password has no unicode below 100, no numbers, at least one letterlike symbol, an alchemical symbol, and ofc right angle with downwards zigzag arrow. The combination should summon a demon to your location, and if a character is misplaced the demon shall not be contained within the circle.

@quinn @maxleibman This is how I lost access to my CompuServe account.
@crypticinquiry @maxleibman ...but gained access to the unspeakable darkness?
@quinn @maxleibman That's the thing about the unspeakable darkness - I don't like to talk about it.

@quinn @maxleibman Problem is that most #password prompts I know stuggle with anything beyond #ASCII - with some luck it'll be able to handle #ISO8859-15 with ร„ร–รœ & รŸ as letters...

Also making #Emoji as passwords isn't really conducive since there is no good, useful and standardized way to enter these on a regular-ass keyboard.

Espechally with modifiers...
I.e. How do you type
"White + Black nonbinary couple with Asian nonbinary Child" on a keyboard?!?

@quinn @maxleibman

Also no #PasswordManager supports it, and we might just end up with shitty passwords like:

 ๐Ÿ‘ ๐Ÿ† ๐Ÿ‘ ๐Ÿ’ถ ๐Ÿ’ฏ ๐Ÿ†— ๐Ÿ†’ โ€ผ๏ธ

@kkarhan @quinn @maxleibman It's 7 years old now, so might need an update but...

https://www.youtube.com/watch?v=lIFE7h3m40U

The Art of the Bodge: How I Made The Emoji Keyboard

YouTube

@cabebedlam @quinn @maxleibman As much as I like @tomscott's #EmojiKeyboard, this ain't gonna work - period.

If it takes up more space than a 100% 122-key - Keyboard, even people like #Chyrosran22 and myself are checking out...

Most people won't even consider something that requires more than a 65% layout and more than a 3 button combo. [i.e. CTRL+ALT+X]...

@maxleibman better, passwords that can't abide to share a mind with one another ...
@maxleibman @cstross My password manager has an option for generating pronounceable passwords. The results _do_ sound like what youโ€™re describing there. I wonder whatโ€˜s the story behind thatโ€ฆ

@maxleibman

Pshaw, I've been using pฬตฬšอ อ’ฬ†ฬšอ˜ฬˆฬฬ€ฬ†ฬพฬซฬ™ฬฅอ•อ‰อ”ฬฐฬขฬ™ฬปฬชaฬทฬ€ฬ‰อ อƒอ›ฬ•อ’อ˜ฬ‰ฬงฬฐฬนฬฆฬ˜sฬธฬฟฬอ˜ฬอฬŽฬƒฬ“อฬ›อ›ฬ…อ˜อ•ฬคฬฎอ–ฬ™ฬฐฬบsฬดอ‹อƒอ‹อออฬปอˆฬ™ฬขwฬตฬออ„ฬอˆฬ ฬกอ–oฬธอŠฬ‚ฬ†ฬ‹ฬŠฬŽฬŒอ€ฬอŠฬ˜ฬ–ฬ™ฬญอ•อ”ฬบฬกอ”ฬ™ฬ˜ฬญฬฒฬขrฬทอ›อŠฬ‚อ‹อŠฬ‰อ†ฬ‰ฬอƒอŒฬฉอ“อ“ฬฑฬœอ‡ฬณฬฬžฬงฬฬซออ™ฬฌdฬธอ€อ‹อ—ฬ”อฬˆอ‘ฬ€อ’อ‚ฬ†ฬฟออ—ฬปฬขฬณฬจอ”ฬ–ฬฏอ–1ฬทฬอ›ฬ›ฬ”ฬ€ฬออ’ฬฬ‰อ‚อ‹ฬŒฬ…อŒฬกฬบฬ™ฬ–อฬบอ…ฬ˜ฬคฬขอ•ฬžฬฒ my whole life and nobody has ever guessed it...

@maxleibman Langfordโ€™s Access Token?
@maxleibman reading the comments on this post crashed my phone and Iโ€™m not kidding. Mission accomplished?
@maxleibman I'm for creating a password that is an memetic that induces psychic distress....this sounds like some SCP shit.
@maxleibman I tried to make my password The Parrot but apparently it had too many angles...
@maxleibman So what's Nyarlathotep, chopped liver?
@maxleibman I mean, I wouldn't want to look at that ...

@maxleibman

Lacks any special characters and will be rejected.

Maybe โ€œPh'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagnโ€?

@maxleibman once youโ€™ve seen them, you can use them in passwords. Thatโ€™s why I always use fnordhunter2fnord
@maxleibman Better yet, it should be a Langford's basilisk
@maxleibman ::sets every password to "a Cthulhu"::
@maxleibman Your password must include:
1 lowercase letter
1 uppercase letter
1 numeral
1 punctuation mark
1 rune
1 angelic sigil
1 demonic glyph
1 non-printing character
1 aspect of Logrus
1 fragment of Pattern
1 page from Recherche du Temps Perdu
1 token smuggled from an adjacent reality
1 emoji (cannot be poop emoji)
1 terrible non-Euclidean geometry, seething with madness just under its outer skin
1 Chinese traditional
1 Chinese simplified
1 fart ghost
1 ghost fart
@log @maxleibman ...and a Shoggoth in a pear tree.๐ŸŽต

@maxleibman @donmelton my password should summon a great old one?

I mean, I guess I could create a Facebook account.

@maxleibman I don't know most of my passwords, my password manager does. Some of them are so huge they almost become certificates. Everywhere possible I add 2FA.
@maxleibman never spelled that correctly.
@Zeugs Iโ€™ve probably never pronounced it correctly. ๐Ÿคทโ€โ™‚๏ธ
@maxleibman
That's easy หˆฯ‡ษฌสŠl. ษฌuห
@maxleibman @tchambers
Done! Iโ€™ve changed all my passwords to โ€œCthulhuโ€.
@maxleibman got it. All my passwords from now on will be "Cthulu123" this I swear forever and always

@maxleibman

Here is my password generator!

@axnxcamr @maxleibman each ry'leh or fthagen is only 1 bit of entropy, you need about 94
@maxleibman But most websites don't accept passwords containing Old Enochian characters.
@habermas Do they not accept them for technical reasons, or out of fear of awakening the Great Old Ones?
@maxleibman I would guess it's primarily due to limited expertise of UI and Web security personnel. But [email protected] could provide an expert analysis.
@maxleibman +1d4 insanity points every time you log in
@maxleibman Funny, but unless this relevant Xkcd is totally off, the advice is untrue: https://imgs.xkcd.com/comics/password_strength.png
@maxleibman I love that this is a joke from a few years back - because it's funny, but it's outdated advice!
@maxleibman In other words: use a decent password manager like Bitwarden or 1PassWord.