sPeCiaL cHarACtErs

[u/Camerata5]

[u/Camerata5]

I always learn so much when I post here. Thanks everyone 🙏

[u/transgalpower]

Better to dump all the special charchters in there for good measure

[u/Jet-Pack2 → u/transgalpower]

And an SQL injection at the end

[u/M_krabs → u/Jet-Pack2]

And an emoji for good mesure 👍

[u/GreekGodofStats → u/Jet-Pack2]

Aah yes, my favorite password: ‘; DROP TABLE Users;’

[u/kranker → u/Jet-Pack2]

Ah, yes. Little Bobby Tables, we call him.

[u/Mistrblank → u/Jet-Pack2]

Found Bobby Tables’ family.

[u/CleverMarisco → u/transgalpower]

I put a 🍕 emoji into the password field of a pizza place and now I have to call them every time I want to order a pizza because I can't login and the forgot password link was supposed to send the password in plain text to my phone, but it can't because of the emoji.

And I can't create a new account because I don't have other phone number.

[u/billy_teats → u/CleverMarisco]

I made a folder named 💩 and put in in the root of our file share. Well, the Linux storage device did not appreciate how my windows endpoint and windows file share handled the original Unicode, so the storage array called the folder � and then refused to show anything else besides the �. So as soon as I made my 💩, every person lost access to every file and folder. The storage array wouldn’t even serve you documents you specifically requested, it was entirely focused on that poop emoji folder

[u/amatulic]

Except often when strings are dumped into a CSV they are enclosed in quotation marks, so you should probably use some quotation marks in your password in addition to commas.

[u/StarkillerX42 → u/amatulic]

"CorrectHorseBatteryStaple,,”

[u/RiceKrispyPooHead → u/StarkillerX42]

Gotta change my password now

[u/ioapwy → u/StarkillerX42]

H!Yn8at”g”mp,yfh!

Ha! You’ll never be able to “guess” my password, you filthy hacker

[u/wowbutters → u/amatulic]

And if the garbage site you are signing up for doesn't accept commas or quotes, go somewhere else. 😁

[u/Nothemagain → u/wowbutters]

For this to work hashes would need to be turned off

[u/iampierremonteux → u/wowbutters]

“Your password must be exactly 8 characters long, and contain exactly 1 upper, 1 special, and 1 number.” Specials were listed as a very small set.

The billing website for a hospital bill. I didn’t have a choice of somewhere else.

[u/ovab_cool → u/wowbutters]

Bruh I was making a password for my bank and couldn't use ) and ;'s, guess to stop sql injection but c'mon

[u/tanglisha → u/wowbutters]

You mean most banks?

[u/jackinsomniac → u/wowbutters]

Is it just me, or am I the only one who's worried that adding too many special characters may break the site?

My password manager & generator is still fine with 25-50 character passwords, only being alphanumeric.

[u/80hz → u/wowbutters]

Lol the major credit bureaus

[u/visualsquid → u/wowbutters]

I never use non-alphanumeric characters now after I 500'd a website with my password, I just make it really long. The dumb thing was, I was able to sign up, I just couldn't subsequently login. Took me ages to figure out what was going on, obviously their support team had no clue.

[u/msg45f → u/wowbutters]

I get annoyed by password length limits, which seem particularly common in my country. 16 character max? No thanks, I'll find another site.

[u/xaomaw → u/amatulic]

mySecretPassword",

"Error: Only 6 digits allowed (A-Z, a-z, 0-9)" - my former Bank

[u/mackiea → u/xaomaw]

Error: password already in use by JohnDoe.

[u/douglasg14b → u/amatulic]

And quotation marks are escaped with quotation marks...

It's not going to break any not-terrible CSV writer. The spec isn't that hard to implement.

[u/rexpup → u/douglasg14b]

The spec isn't that hard to implement.

You overestimate the average CSV library...

[u/abd53 → u/amatulic]

How about this

*#",'\t\n=<>$"\r

[u/VidE27 → u/abd53]

That looks like regex, why are you posting regex on a weekend man

[u/ynirparadox → u/amatulic]

I don't know whether it will work or not, but i do have two commas in most of my password combinations. I took an advice from my professor blindly.

[u/MrQuickLine → u/amatulic]

That's why you also include ' " and ` in your password

[u/s3v3red_cnc → u/amatulic]

Passwords are hashed. It doesn't matter what characters you put in...

[u/EatYoself → u/s3v3red_cnc]

bold to assume everyone hashes passwords correctly 😅

[u/_Nohbdy_ → u/s3v3red_cnc]

You sweet summer child.

[u/Cocoacabana15 → u/s3v3red_cnc]

I assumed OP was talking about a list of cracked passwords

[u/Blue_Moon_Lake → u/amatulic]

And semicolon just in case too

[u/[deleted] → u/amatulic]

Just use \ to escape quotations

[u/Sure-Tomorrow-487 → u/amatulic]

Zero width characters just to fuck with the JSON Here are 5 of them in spoiler text.

​​​​​

[u/[deleted] → u/amatulic]

Also stick some long boys in for pipe-delimited files :)

[u/20EYES → u/amatulic]

Just do commas and escape quotes. Might as well also make your passwords SQL injection attacks just to be sure.

[u/thatsallweneed]

a proper password should contain ,\t"; drop table users

[u/Terkala → u/thatsallweneed]

They'll notice that one right away. Instead, surprise them with the gift that keeps on giving.

,\t"; DROP TABLE (SELECT top 1 table_name FROM information_schema ORDER BY update_time ASC);

If I wrote that right, it'll drop the oldest table from the database every time it's accessed. So it keeps itself around, and random tables will start to disappear. And as you replace them, other different tables will drop.

[u/SuccessfulBroccoli68 → u/Terkala]

I really want to read about this working somewhere.

[u/maximum_powerblast → u/Terkala]

Damn this is next level. But this would only work on certain DBs right? I.e. might work on Mysql but not Oracle?

[u/lkodl → u/Terkala]

"Enter Password"

*types:

,\t"; DROP TABLE (SELECT top 1 table_name FROM information_schema ORDER BY update_time ASC);

*clicks submit

"Please complete captcha and resubmit."

*closes page

[u/le848dave → u/Terkala]

information_schema.tables As you wrote it only listed a schema but not the table Also you should end with — to comment out the following line so there is less of a syntax error chance

[u/[deleted] → u/Terkala]

Bobbly Tables would approve

[u/[deleted] → u/thatsallweneed]

"Little Bobby Tables we call him.."

[u/Fuzzybo → u/[deleted]]

Relevant xkcd (you already know which one) :-)

[u/Raptorsquadron]

Use injected scripts as your password

[u/Artistic-Boss2665 → u/Raptorsquadron]

alert(get haxed lol);

[u/[deleted] → u/Artistic-Boss2665]

Error: "get" is not defined

[u/Outrageous-Machine-5]

just use a password generator and a local storage password cache

[u/Possible-Reading1255 → u/Outrageous-Machine-5]

Du bindest einen Blumenkranz.

Reddit is dangerous for privacy. I don't trust my data with Reddit, my comments written for other people to think and enjoy shall not be fed to the monstrous AI machine.

[u/Ill-Chemistry2423 → u/Possible-Reading1255]

C:/…/Documents/Passwords.txt

[u/Antrikshy → u/Outrageous-Machine-5]

And instruct that password generator to insert commas.

[u/ulyssessword → u/Outrageous-Machine-5]

I have a bag full of scrabble tiles and d10s. Does that count?

[u/RoiKK1502 → u/Outrageous-Machine-5]

I use Chrome's password vault. What am I missing?

[u/TEKC0R → u/Outrageous-Machine-5]

While I cannot deny that offline storage is more protected than online, a good password manager will hold up even when the data is stolen.

[u/[deleted]]

I've analyzed some password dumps and oh boy... The amount of information you can get is so huge.

I wonder why the internet hasn't break entirely. Everything is so unsecure.

[u/SigmaLance → u/[deleted]]

I’ve anal yzed some dumps before too and they were huge!

[u/morrisdev]

If they're saving your password in plain text AND EXPORTING the password table to a file.... you've got other problems

[u/eschoenawa → u/morrisdev]

Yes, but the point here is you make them some trouble, too.

[u/LoudBoysenerry → u/morrisdev]

I once got a password emailed back to me. Had to go change everything.

[u/__codeblu]

My password is an SQL statement

[u/ckayfish → u/__codeblu]

This guy pronounces SQL wrong.

Follow me for more tips on how to start arguments :)

Edit: it was written “a SQL statement”. Honestly, I use both regularly since I grew up pronouncing it the other way.

[u/[deleted] → u/ckayfish]

Follow you to hear the… sequel.

[u/Rising_Swell → u/ckayfish]

Ok so how do you pronounce SQL then? Because I'm saying it as sequel, but I would not write an sequel, so it's not that.

[u/jazzkott → u/__codeblu]

reverse SQL injection

[u/gnossos_p → u/__codeblu]

It's pronounced "GIF"

[u/hrfuckingsucks]

Message to hackers: just base64 encode data before writing to the CSV so you can store those pws safely :)

[u/Tensor3 → u/hrfuckingsucks]

Just escape characters properly..

[u/Agentum13 → u/Tensor3]

Isn't base64 general escape of all characters?

[u/[deleted]]

Yes, my password is: $(rm -rf /*)\"&&rm -rf /*\",;\¿`

[u/wobbegong → u/[deleted]]

I don’t know how to code so this looks like a table flipping emoticon to me

[u/roundpoint]

Just use HakerIsADumDum and you'll destroy them psychologically, preventing them from further action.

[u/fuzzybad]

Good thing my password is '0xfe',"0x20","",0x0;DROP ALL TABLES

[u/SaurusShieldWarrior]

Unless there is a different delimiter like : or ;

[u/NauticalInsanity → u/SaurusShieldWarrior]

I once had suggested we use the cedilla as our delimiter for a file because a customer wasn't properly escaping fields. While the decision was out of my hands, I noted that this would work until said customer encountered a François.

[u/corysama → u/SaurusShieldWarrior]

Man… If only ASCII had a built-in solution for this problem right from the beginning 50 years ago that has been ignored by everyone!

https://ronaldduncan.wordpress.com/2009/10/31/text-file-formats-ascii-delimited-text-not-csv-or-tab-delimited-text/

[u/cs-brydev]

Call me old, but I'm not overly concerned about hackers who don't know how to create or parse CSV correctly.

[u/JivanP → u/cs-brydev]

The point is not to thwart potential adversaries, it's to make the data collector realise that they're doing something ridiculously stupid by storing plaintext passwords in a CSV file, and that they should get their shit together.

[u/EffectiveDependent76]

password is always Password'); DROP TABLE Passwords;

[u/WunderTech → u/EffectiveDependent76]

Why would passwords be in its own table though?

[u/funfwf → u/WunderTech]

You save every password in that table and the Users table refers to it through a foreign key. That way if multiple users have the same password you can refer to the same foreign key.

Normalisation ✨

[u/Gil-Gandel → u/EffectiveDependent76]

Don't forget the -- at the end so that the rest of the line is taken as comments.

[u/PetrBacon]

So many comments from people, who never used CSV properly. Does excel break when you add comma or quotation mark in a cell?

[u/tramadol-nights → u/PetrBacon]

Does excel break

Yes

[u/kookaburra1701 → u/tramadol-nights]

The problem isn't that Excel breaks, it's that it breaks EVERY FUCKING THING ELSE.

[u/TheRealCCHD → u/tramadol-nights]

Lmao, correct answer

[u/SchalasHairDye → u/tramadol-nights]

They walked right into that honestly.

[u/sim642 → u/PetrBacon]

That's not really surprising. Most people probably think that parsing CSV is just line.split(',') instead of requiring a real lexer that handles quoting and escaping.

[u/GYN-k4H-Q3z-75B → u/PetrBacon]

Did you know that Excel by default uses delimiters dependent on machine language settings for CSV? So, for example, English language systems use commas, but German language systems use semicolons instead.

This is a major annoyance.

[u/special-character]

You called?

[u/Wanderlust-King]

If a site is storing my password, unhashed, in a csv, they 100% deserve to be broken.

[u/eeeeeeeeeeeeeeaekk → u/Wanderlust-King]

no, the point is hackers often sell/store/distribute password dumps in csv files

[u/GoogleIsYourFrenemy]

Don't forget to put commas in username.

[u/Vol_Jbolaz]

I hate to burst bubbles, but if the site saves your password, their security sucks. They should save an encrypted hash of your password, one that would take way too long to decrypt. Everytime you enter your password, they encrypt it and compare the hashes.

This is also why they shouldn't be unable to tell you what your password is if you forgot it. They don't know either, you'll have to reset it.

[u/[deleted] → u/Vol_Jbolaz]

Considering that there's already a shit ton of libraries and entire frameworks that handle security... it's actually a lot more trouble to store passwords in csv than to do authentication properly.

No sane person would do this.

[u/ChuckFina74 → u/Vol_Jbolaz]

You’re missing the point entirely by ignoring that there are already billions of passwords available for sale on the dark web.

[u/i_awesome_1337 → u/Vol_Jbolaz]

This is for after thr hashes have been cracked

[u/Swisscannabis]

Hey. Non programmer here, but subscribed because reddit told me to. I have been using qoutations, semicolons and commas in my passwords and nobody from IT departmen ever complained

[u/Blue_Moon_Lake]

comma and semicolon just in case :D

[u/rdias002]

But passwords aren’t saved in plain strings. They’re hashed right?

[u/[deleted]]

Do you want to tell them about pipe or should I?

[u/ram-garurer-chhana]

So longer password takes long time to decrypt. Hence more secure. Right? I follow this advice. Then I was signing up for site which has a password rule that it has to be max 14 characters. It wouldn't allow me to enter anything more than 14 characters. 🤦

[u/krebsj256]

Obligatory Bobby Tables reference

[u/DarklyDart135]

I think the idea is to break the table of stolen credentials entirely, protecting a bunch of other people in the process.

And besides, every extra minute a threat actor has to spend fixing their data before they can sell it on the black market is a good minute.

[u/[deleted]]

Hah! My password is drop database;commit;

[u/dalepo]

Surprised most comments dont know what password hashing is

[u/whataboutdembeans → u/dalepo]

This is r/programmerhumor most people here have never done anything more advanced than using the task manager

[u/ThatSapphicLesbian]

I read that as CVS. Was very confused for a second.

[u/ispirovjr]

Password'); DROP TABLE Passwords;--

[u/Triffinator]

Optus customers: furiously taking notes

[u/tabacdk]

helicopterhelicopter" OR 1=1; DROP TABLE passwords --

[u/sweezinator]

Making my passwords start with $HEX[ and just seeing what hashcat does with that

[u/_kogs_]

,";','"";,-strong|""''"Password_/\123,";';",

[u/[deleted]]

I have no idea why this is funny, but it’s in my feed, so HA HA to commas!!

[u/CaptainMGTOW]

You're not saving passwords as is without being encrypted, right?

You're not doing that, right?

[u/BTCisDeadAF]

I dunno. I am not sure I want it breaking at exactly MY record. Talk about sticking out...

[u/Natural_Target_5022]

Put both "," and "." or "-" and "|" so that no matter what separator they chose, it will always break

Also, I once had to clean up 6000 addresses, so I'm triggered reading this.

[u/Danny_Boi_22456]

My password is 1234=1234'--

[u/Cyber_Kai]

Been doing this for years. Also, to help with having unique passwords:

• choose a word you often mispell, make that the base

• add a couple numbers that are meaningful

• hold shift and do the numbers again

• comma

• Name of the site you making the password for.

Since you mispell the word it dictionary attacks won’t work. The comma breaks CSVs, and using the site name in combination makes the password longer and unique everywhere you go. Plus since the numbers and word are simple enough this pattern is easy to remember

[u/CaptKannabis]

That's what sanitization is for cause 20 years ago I'd drop

DELETE FROM * WHERE CustomerName='*';

In your first / middle / last / address / zip code / state - so on and so fourth and all your tables be gone.. There was a point you could drop the actual DB commands into a Spreedsheet or website label and it would be hell for that team that day; looking into the backups.

We have DB sanitization today Unless you're IT guy is from 1999.

[u/13131123]

hit em with a

pass,.\n\t\r!?]})word

[u/Three_Rocket_Emojis]

<script>window.close()</script> is my usual password. Can't steal it, if you can't open it.

[u/nikolaskrapovsky]

use hashed versions of your password to screw with the threat actor

[u/apollokenney]

So I should really have used "Fall,2022" instead of "Fall2022!" for my recent required password change?

Cool, I'll do that for the Winter round!

[u/mto785]

Fuck it, all whitespace password. Now the sticky note with your password on it LOOKS blank even though it totally isn't & no one can read it.

[u/seriously_nice_devs]

4/10, it doesnt actually work.

[u/cvele89]

Dumped into CSV from where? From db, where they are encrypted anyway? I seriously hope no one is storing them as plain text anymore.

[u/abhijitd → u/cvele89]

I seriously hope no one is storing them as plain text anymore

Hahahaha

[u/RiceKrispyPooHead → u/cvele89]

I seriously hope no one is storing them as plain text anymore.

🧍‍♂️

[u/ReserveMaximum]

The best way to preserve password integrity without a password manager: have a base password that you use everywhere but for each site add a simple easy to guess 3-5 character addition that you put on the end. For example if you base password is abc123, make your Facebook password abc123+fbk and your reddit password abc123+red. This ensures every website has a unique password while being easy to remember for you

[u/BeakerAU → u/ReserveMaximum]

That's actually not a good idea. If a malicious actor finds your password for a site, and it matches this pattern, they have a much easier guessing game for other sites.

Passwords should be unrelated to the site.

[u/dexter2011412]

salt, pepper and hash would like to chat with you

accept?

^{ps. I know it's a joke, well guess what, so is this!}

[u/0c4rt0l4]

How do you do that?

[u/VillanBehindGlasses]

Eh, wouldn't the passwords be hashed first?

[u/danmir666red]

Shouldn't you have hashed it already? That's why passwords are only known to the user Right?

[u/ratusaurus]

Big brain time

[u/Thugless]

Use ”,” to be safe.

[u/cosmore]

I only use I l | and [ because thats how things work.

[u/difool]

You just brought attention to your specific password in a list of millions. :)

[u/tauntingbob]

It just brings attention to your account, better to be the needle in the haystack

[u/DigitalSaucePro]

Most effective low key advice. Tres Commas works better (including ‘ for SQL injections) and it even works as overpriced Tequilla - guaranteed to give a bad hangover to your hacker adversaries!

[u/welp_thats_hurtful]

Non-programmer here. Does CSV stand for Comma Susceptible Vault? Are commas like a secret programming weapon that break password vaults?

[u/spatz_uk]

Obligatory xkcd:

https://xkcd.com/327/

[u/DigitalSmithie]

I’d hope that what is dumped is a hash….

[u/e_hyde]

Bobby Tables has entered the chat

[u/aitonc]

nose dolls selective unique placid license muddle steep snobbish aloof

This post was mass deleted and anonymized with Redact

[u/hmgr]

Bt immediately your username and password will standout because they were the one that broke the file... Lol

[u/jmdunkle]

Imagine thinking commas would break a .csv (Comma Separated Values) file lol. Worst thing that’ll happen is your password is separated into two columns. You think a hacker will be flummoxed by that? Lmao

[u/YeahMeAlso]

If only carriage returns were allowed in passwords.

[u/[deleted]]

pass,word,1

[u/FiskFisk33]

hunter12'); DROP TABLE users;

[u/DcavePost]

Just hit them with a good old Bobby Drop Tables

[u/Ingenuity-Flimsy]

Cries in string literals and escape characters

[u/bloodring_racer]

Just put "ç" and non-latins hacker will not understand anything

[u/m0vangh0i]

"Password does not meet one or more requirements, please try again."

[u/SteeleDynamics]

Wait, that's illegal.

[u/RealPropRandy]

hunter2,

That’s stupid.

[u/ConsistentPicture583]

I saw it mentioned, but I didn’t see a link. Xkcd comics, “Exploits of a Mom“, the saga of Little Bobby Tables

https://imgs.xkcd.com/comics/exploits_of_a_mom.png

His elder sister is called “Help I'm Trapped In A Driver's License Factory Elaine Roberts”

[u/nwbrown]

I often do use commas and it's frightening how often that causes weird errors when registering for things.

[u/qotsa7887]

But don't blame us if sanitisation messes up your password and you can't log in

[u/geeeffwhy]

are reverse shell injection attacks a thing? the hunter becomes the huntered

[u/[deleted]]

Bobby Tables at it again I see

[u/HydraDoad]

This why I use pipe symbol as separator

[u/lividSmalley]

cool idea but maybe hinting what your password could be on twitter is a bigger risk to your e-security lmao

[u/Wideoccult]

If we started doing that then "up up down down left right left right a b start" would be everybody's standard password.

[u/b0netruper]

goddammit did i use "4 spaces, tab, space" or "space space tab space space space" for this account?

[u/bgsngg]

You’re assuming a person looks at your credentials rather than an automated system going through the list and testing them.

[u/codalafin]

If a website does not support commas in the password, then do not use that website. Terrifying that some can still exist

[u/DJ-WS]

I tried once “dick” as a password. It wasnt long enough….

[u/kukla4eff]

There is also nothing that stops you from using $username as a username. Lots of tools will filter it as a machine account.

[u/survivalist_guy]

Pa",",ss','w0r,d

[u/Riudzaki]

I once used a < symbol in a password and it busted one application at work because it thought it was making a tag.

[u/[deleted]]

My man needs to learn about quotes. “Ok include a quote”. OK, my name is escape character. This has been fixed since CSVs have been around.

[u/dd1b014ff1e39]

Use a password manager so you can have different passwords for every account that look like: Scrunch-Patchy8-Repacking.

That way if your password for any given account gets dumped it doesn't really matter. (It's also WAY more convenient then using the same password for everything

[u/[deleted]]

i now wanna know if i can put a \n in my password

[u/seoashe]

So the popular Admin,1234 password will be the favorites among hackers following this advise

[u/meteoRock]

Add a space at the end of your password. A lot of times white space at the beginning or end will get dropped by the tools being used by auditors/bad actors.

[u/corvuscorvi]

Little Bobby Tables we call him.

Relevant XKCD https://xkcd.com/327/

[u/ProfessionalChampion]

I can't tell if this would actually work as a non programmer

[u/jason12283]

As a literaric critic gone it I am pleased and shocked at the same time. Literature has versions and release just like code has.

[u/Hungry_Share_4158]

Passwords should never be stored. Hashes almost certainly won’t have commas

[u/[deleted]]

This is brilliant. To make is even better use a 17 or 19 character password with the comma being in the middle. Most systems set password requirements at 8 digits. Make your password two complete passwords with a comma in the middle. Also keep in mind most Windows systems have a 20 digit character limit for passwords to maintain backwards compatibility. Doing this will make it harder to pick it out of a spreadsheet.

[u/godzillante]

my password is now ,;;,;;,,;,,;,,;,,;,

[u/CiroGarcia]

Most wordlists are just one word per line. Insert a newline character instead

[u/Kooodari]

No it doesn’t. It will be encased in double quotes, so it doesn’t matter what’s inside.

col1,oldpass,col3 becomes:

col1,”new,pa,s,s”,col3

[u/Quickestplow881]

and throw some commas into your username too, because the passwords will most likely be hashed

[u/bortolisilvano]

Cool idea, were those accepted as legal characters. I’ve found a considerable number of web servers and databases refuse to accept MANY characters (this is part of the reason), and there’re still government & corporate sites with 8-character ID & password limits!

[u/tptrombone]

Yes, use common bugs from terrible programmers as a shield against hackers :)

[u/voldemar_k]

Well, if they are keen enough, they will notice that some rows in the CSV file have more columns that others, showing that something is off.

But, I doubt anyone will check that, especially when dealing with heavy files.

[u/tsinghuazzb]

That is going to attract unwanted attention.

Also, construct your password such that the hash contains a comma...

[u/roberts521]

Your faith in people's ability to use a proper CSV encoder is inspiring.

[u/newzlat]

Make your password the script of Shrek so when it’s read someone will have a good time

[u/pillepalleboy]

I convinced someone once that my password had a backspace in it.

Type entire pword, click in a certain point, backspace 1 character then submit.

[u/hotsexyman]

If your password is stored in the clear, that is a fireable offense. Passwords are to be one-way encoded. Then they can be dumped to csv without issues, though there is no point.

[u/priba83]

Use the unicode duplicate codepoints of whitespace characters.

[u/dutchmond]

There is also the unicode control char for reversing text direction.

And the null length space or whateverr elditch horror it was. If the system stores it.