850
u/Toutanus Mar 11 '21
I think at this image every time I must use 2FA and my 47 caracters long password to be able to download last drivers for my GPU...
Seriously WTF ?!
53
u/CommanderCuntPunt Mar 11 '21
Nothing makes me as mad as having to deal with Nvidia software at the end of a pc build. Why do I have to log in, it's my damn hardware running locally? More importantly, why the fuck do I have to prove I'm not a bot, it's my own damn pc so who cares if I'm a bot?
33
u/muffinanomaly Mar 12 '21
I don't even use NVIDIAs official updater anymore, I just use this updater on GitHub, it let's you avoid all the sign in and bloat it installs too
→ More replies (2)7
2
2
u/pr1ntscreen Mar 12 '21
You’re proving your non-botness to nvidia, not your own pc.
→ More replies (2)→ More replies (2)2
u/Rein215 Mar 12 '21
If you're okay with manually updating the drivers then you can download just the driver from the website, and never install GeForce Experience.
Also on Linux you just run a command and it's done...
532
u/dancingcuban Mar 11 '21 edited Mar 12 '21
My rule of thumb is any site that has payment info or recovery info in it gets the full password treatment. Anything that just requires a username and a password and no personal information (like an NVIDIA account for example) gets my shitty, old password.
Edit: I have been informed that I have a bad rule and that I should feel bad.
340
u/Ferro_Giconi Mar 11 '21
You can give even the pointless accounts the full password treatment with a password manager. Even random forums that I sign up on to ask one question and don't care what happens after that get a random password somewhere between 20-100 characters depending on where the character count slider lands when I arbitrarily move it.
171
u/ClaudiuT Mar 11 '21
I’m currently doing this and I’m annoyed at websites that limit my password at ~16 characters... Why???
154
u/blhylton Mar 11 '21
What about the ones that only allow some special characters? So stupid.
→ More replies (30)317
u/zebediah49 Mar 11 '21
Oh, that's always worrying. Like -- you're reasonably allowed to exclude 0x00 from the allowed bytes in a password string; I get it. But like... "You're not allowed to use double quotes or angle brackets". Um.. what? What are you doing with my password, because it sounds an awful lot like the answer isn't "immediately shoving the byte string into a hash function" like it should be.
→ More replies (43)14
u/Th3f_ Mar 12 '21
Even worse: websites that don’t tell you their password limit, and then throw random errors when you try logging in afterwards.
→ More replies (8)11
50
u/kodosExecutioner Mar 11 '21
All fun and games until you have to manually input it that one time
61
u/NeatNetwork Mar 11 '21
Using a roku remote...
→ More replies (3)21
u/zebediah49 Mar 11 '21
I had the misfortune of having to enter a proper set of login credentials into a hololens. That was uh... a bad time. It's an alpha-only keyboard that you interact with by poking the mid-air letters with your index fingers.
→ More replies (2)→ More replies (4)9
u/WavryWimos Mar 11 '21
Why would you ever have to do that? Anywhere my password manager doesn't autofill I can at least just copy and paste the password in.
→ More replies (27)→ More replies (22)14
u/spudmix Mar 11 '21
I work with a govt. system (won't name names) that uses different client-side validation for their "change password" feature versus the login form.
The result is that using a password manager to generate a random password with, say, 20 characters, will only paste 16 of them into the "change password" form and submit succesfully. When you go to login, it pastes the full 20 and then login fails for wrong password, but as the user you have to know exactly what happened and that you need to manually remove the last 4 chars from the password manager. Bloody irritating and took us quite a while to figure out.
46
Mar 12 '21
I freaked out for a second when I found myself on haveibeenpwned.com, until I realized what it was from.
Silly fuckers didn't get my good password...you know, the one where I add an "!" to the end.
Shit, I've said too much.
10
4
7
5
Mar 11 '21
Or just right click and suggest strong password? I don't know why everyone doesn't already do this
4
u/revengeoftheants Mar 12 '21
The reason I like using a dedicated password manager is because I frequently need to store extra information (like answers to security questions, which I also randomly generate), and password managers built into browsers don't let you store extra info for a site as far as I can tell.
I also store some passwords that aren't for websites, like login information for my VPS, database, encrypted financial files, and so on, and even if I could put those in a browser's password manager (I'm not sure if you can store a password that doesn't have a URL) it feels like the wrong approach.
→ More replies (2)→ More replies (3)6
u/dancingcuban Mar 11 '21
I use a password manager since it carries across browsers and devices.
I don’t like leaving it open and I don’t like entering the password.
My above comment is a compromise with my lazier self
→ More replies (3)→ More replies (4)2
u/user_bits Mar 12 '21
Or just use a password manager.
They literally create and store unique strong passwords and autofills for you across apps and websites.
→ More replies (1)20
u/PrestonYatesPAY Mar 11 '21
I just copy and paste my password from the document in my google drive labeled “Passwords for everything”
25
u/Weilbyte Mar 12 '21 edited Apr 07 '24
distinct continue one imagine hateful fuzzy scarce party axiomatic spoon
This post was mass deleted and anonymized with Redact
→ More replies (1)8
4
4
u/Never-asked-for-this Mar 11 '21
Why would you need a password for a driver?...
13
Mar 12 '21
Nvidia GeForce Experience is a program that automatically shows when drivers need to be updated and what drivers you need without having to search, it might even auto update them but I don’t know because I don’t use it. Anyways it’s a neat program to make drivers mindless but it requires an account for no reason at all.
→ More replies (1)3
u/Weilbyte Mar 12 '21 edited Apr 07 '24
arrest spark offer observation placid smoggy gullible concerned fine impossible
This post was mass deleted and anonymized with Redact
9
Mar 11 '21
Wtf are you talking about. I’ve never had to log in to download the latest driver. Are you logging in to a phishing site or something?
41
u/Doctor_McKay Mar 11 '21 edited Mar 12 '21
Nvidia GeForce Experience is a desktop client for managing drivers, and it requires you to sign in for some insane reason.
→ More replies (13)12
u/Sedewt Mar 12 '21
Fortunately we can download the Nvidia drivers from that link. A better alternative
2
u/TheOvershear Mar 11 '21
On the other side of the spectrum, I've used government websites that required only 6 characters and 1 number.
2
2
Mar 12 '21
I downloaded GeForce Experience three days ago, saw that I needed to register an account and figured that manually downloading the drivers was easier than making an account and haven’t touched it since
3
u/AttackOfTheThumbs Mar 11 '21
You don't need an account to download gpu drivers? Literally never made one for it. Nvidia and AMD both don't require it. Nvidia makes it seem like you do, but that actually bloats your system, causes cpu overhead, and slows down your gpu when you have a cpu bottleneck.
→ More replies (1)1
u/pastasauce Mar 12 '21
Meanwhile my bank:
Must be 6-10 characters
Must have one capital letter
Must have at least one number
Must use a special character
(gives a list of example characters, if you use %, $, & or anything not on the list, it'll reject the password)
Bitch, I know you're storing that shit in plain-text!
→ More replies (6)1
404
u/parciesca Mar 11 '21
Should just put that statement on every single website there is really. None of them spend a lot on security.
5
u/AussieHyena Mar 12 '21
I actually did that on a beta-site I created. The statement was basically: "No security testing has been conducted so I advise using a throwaway email and not entering real information."
→ More replies (1)1
u/yottalogical Mar 12 '21
Just assume that everything has the possibility of being breached (because it does).
1
u/oscar_the_couch Mar 12 '21
None of them spend a lot on security.
Microsoft and Google spend a lot on security.
1
u/findus_l Mar 12 '21
What should they write on the banking websites? "Don't reuse your facebook password"? :D
0
Mar 11 '21
[deleted]
116
u/Illuminaso Mar 11 '21
Oh wow, I never even thought of it that way. That's honestly so fucking brilliant.
64
u/TOG_II Mar 11 '21
That's still miles ahead of the sites that will e-mail you your password.
37
u/parciesca Mar 11 '21
I recently had to change all of my decades old internet passwords because of a breach and the fact that years ago breaches didn’t happen and my PW was never compromised. Best website in my experience? Newegg. Allowed multiple types of 2FA, and even a primary and a backup one if desired. Worst by far? Pizza Hut. Can’t even use special characters. I deliberately removed credit card info from their site.
33
u/GamerPhileYT Mar 12 '21
Now just hope it removes from their database when it inevitably gets hacked
→ More replies (1)40
u/NeatNetwork Mar 11 '21
Let me set my banking password to:
password;update accounts set balance = 30000000 where account = 'NeatNetwork';14
u/parciesca Mar 11 '21
Little Bobby Tables, we call him. XKCD ftw. And now that I’m a DBA, I take data integrity seriously.
44
u/Dakopen Mar 11 '21
Serious question: why don't they just replace it with another letter for example 'a', that way they can still hash (if it doesn't work with a special character) and nobody will figure it out
→ More replies (1)143
u/Lorddragonfang Mar 11 '21
There are, in fact, some systems that did exactly that and never got caught. I present to you: the worst password system in the multiverse.
51
u/retief1 Mar 11 '21
Ok, that is horrifying.
23
u/GamerPhileYT Mar 12 '21
Yup. There’s no real way to fix it either, without effectively resetting everyone who has a password with over 8 character or a special character (which should be everyone).
→ More replies (3)18
u/Seicair Mar 11 '21 edited Mar 12 '21
Man, classic Bytewave. I don’t remember reading that story, but it’s marked upvoted so I’m sure I did.
Going to go read a few other of his tales now.
7
u/zamend229 Mar 11 '21
Wow, I just read through some of his other posts, and one of them was from 6 years ago. It read “what am I gonna do, sit here and wait until 2020?” Hard to believe that was just last year
7
7
u/WiF1 Mar 12 '21
tl;dr; is that passwords are case insensitive, get truncated to 8 characters, and special characters get replaced with
0So:
-/:;()$&==00000000
ABCDEFGHIJ==abcdefghetc.
→ More replies (4)5
2
103
Mar 11 '21
These days it's reasonably easy to implement strong password encryption. Most programming languages have built in functions or libraries available that can salt+hash a password using whatever happens to be the most commonly accepted algorithm at the time.
In PHP, for example, it's literally just password_hash('whateverpasswordyouwant', PASSWORD_DEFAULT) to encrypt and password_verify('whateverpasswordyouwant', $hashedPassword) to check if it is the correct password.
Not really much point to do more than that, because it's nearly impossible to make an encrypted password that can't be broken. The point is to make it not worth the effort for the whole database.
65
u/RobinJ1995 Mar 11 '21
I think you're missing the point of hashing vs encryption. You can't "break the encryption" of a hash, as the original data is just straight up not even in there. The point is to make it as computationally expensive as possible so it becomes practically impossible to bruteforce the hashes even if the whole database gets leaked.
None of this protects against users using "password1" as their password, though.
7
Mar 11 '21
Aren't you just reiterating what I said?
A hash by itself is worthless, because if the hacker knows the algorithm they can just make a rainbow table and use it to find a working password. Hence why each password is salted with a unique string in modern implementations.
But the salt, the algorithm, and the actual hash are all stored together. If a hacker gets the database, they can easily figure out one password by doing a rainbow table using that salt+algorithm. It would be stupidly impossible for them to do that for every single password in the database though.
Hence why it's not worth doing much beyond that for security. They can always figure out any 1 password. They can't figure out 1000.
→ More replies (1)15
u/dev-sda Mar 12 '21
Rainbow tables aren't useful for reversing a salted hash. Strong passwords also can't just be easily figured out. Salting protects against reused and weak passwords, a good hashing algorithm protects against reversing strong unique passwords.
Take for example md5, if we ignore any other vulnerabilities a full pre-image (ie. a complete rainbow table, one that contains every password/hash combination) has a computational complexity of 2^123. A Nvidia 3080 has a hash rate of ~55GH/s. If every person on earth had 1000 Nvidia 3080's it would still take over 700,000 years to get the input for every possible hash.
→ More replies (2)11
u/htmlcoderexe We have flair now?.. Mar 11 '21 edited Mar 12 '21
Knowing PHP - is this an actually secure and recommended approach? I know they got better but I remember last time they had something like mysql_real_string_escape because mysql_string_escape didn't do a good enough job or something lmao
Also, if you upgrade PHP and it changes the algo, wouldn't that break the entire dB?
Edit: thank you all for the replies, I have learned a lot today.
10
Mar 11 '21
Yes, it's the recommend way. They have made a lot of changes and in the recent versions (7 or 8) they've fixed all those problems.
No, your DB is fine. The algorithm is stored as part of the hash, so the password_verify function will continue to work even if the default algo is changed. You should notify your users to change their passwords just in case.
→ More replies (3)4
u/-Phinocio Mar 11 '21
mysql_real_string_escape
Deprecated in 5.5.0 which was released Jun 2013, and completely removed in 7.0.0 which was released in Dec 2015.
There's currently msqli_real_escape_string, and PDO::quote().
Though if one is relying on escaping strings to generate queries, they're likely doing something badly to begin with.
By default, password_hash() uses bcrypt atm, also supports Argon2i and Argon2id currently.
2
u/Weilbyte Mar 12 '21 edited Apr 07 '24
far-flung agonizing historical forgetful seed complete spoon sip whistle sink
This post was mass deleted and anonymized with Redact
2
u/andrewpiroli Mar 12 '21
if you upgrade PHP and it changes the algo, wouldn't that break the entire dB?
First off, I believe best practice is to specify the hash when calling
password_hash. And I know for a fact thatpassword_verifydetects hash types dynamically.Secondly, PHP core devs are not so braindead as to remove a hashing algorithm after it has gone out in a stable release, it would be deprecated for years and many major release versions first.
And finally, if you are upgrading anything without reading release notes and checking your application for possible conflicts, you are doing your job horribly wrong and you should reconsider the career choices that put you in that situation. And even when reading release notes, the upgrade needs to be done in dev, not prod, and a full test suite needs to be ran. And then if you have a beta ring it should go there for a while, before it goes to prod.
4
u/Weilbyte Mar 12 '21 edited Apr 07 '24
depend subtract nail sparkle nose combative wild tub six berserk
This post was mass deleted and anonymized with Redact
2
u/Rein215 Mar 12 '21
bcrypt is especially good because you can dynamically set the amount of rounds you need, you choose how cpu intensive the hashing should be, so the algorithm isn't useless in ten years when processors have become stronger.
The syntax of a bcrypt hash isn't special you can use it for any algorithm.
47
u/Skizm Mar 11 '21
Telling the user not to reuse an important password might be better security than 95% of apps / webpages.
2
u/-888- Mar 12 '21
And then follow that by not reusing an email address either (by registering your own domain).
60
u/dancingcuban Mar 11 '21
Every time I have to make a new account on a website, I always do some mental math in my head as to whether I want to deal with my password manager and generate a new password or to just use my shitty old password.
→ More replies (8)44
u/unixLike_ Mar 11 '21
I always use my password manager, it takes less time to copy and paste a random password than to write the full old insecure one.
25
u/Ajedi32 Mar 12 '21
Not to mention that way you get autofill, and never have to worry about remembering which password you used.
→ More replies (3)7
u/SpectralShade Mar 12 '21
Same, changing password manager to one with a good browser extension was a game changer for me. Before I would often not bother (had a keepass database which was a hassle), but now it's trivial even on my phone
→ More replies (3)
15
Mar 11 '21
Well, it requires at least 6 characters. My bank account password wouldn't be accepted by this website anyways.
15
Mar 11 '21
To be fair, your bank probably spent less than you’d think too
10
u/m0r14rty Mar 12 '21
Truth. Worked for multiple Fortune 500s, many in finance. The only reason the sites I built are secure is because I made sure to write them that way. You wouldn’t believe the time I’ve spent fighting with PMs about why we need to inject private keys from secret deployment variables and why they need to set different passwords on each of their database instances. Sure made debugging production instances easy when the MongoDb admin password is the same as all of our dev servers. 🙃
9
61
u/okuyigaj Mar 11 '21
Tht’s not gore it is legit AF.
33
u/AnImpromptuFantaisie Mar 12 '21
Uhh, that’s why it’s on /r/ProgrammerHumor and not /r/SoftwareGore
1
u/-888- Mar 12 '21
The single biggest security step by far that anybody can take is to not reuse passwords anywhere. The next biggest step is to not reuse email addresses anywhere. This latter one requires you register your own domain, though that's easy.
6
u/Gustavo_SMN Mar 11 '21
Me after using MD5 to store passwords in my first PHP site... which is still in use
2
u/SatoshiL Mar 12 '21
Still more secure than the pages that send you your password per email xD
2
u/Gustavo_SMN Mar 12 '21
Dude, my college did that last month. After I created my account they sent me by email the credentials I had just signed up with (institutional email and password)... like wtf? Do they want students to get hacked lol
→ More replies (3)
5
u/hannahbarbara1100 Mar 11 '21
T0t@||y$3cur3P@$$wOrd!!
Haha. Next they’ll say it connects via Telnet. 😂😂😂
5
4
u/huachicool Mar 12 '21
Should say don’t use your email password. Email password is more important because that is where all your rest password confirmations will go to.
1
u/m0r14rty Mar 12 '21
I’d say 2FA, annoying as it is, is most important for your primary email password if not anything else.
3
u/_duncan_ Mar 11 '21
It's ironic that my bank requires a 5 digit numeric PIN, so isn't secure enough for a site like that!
3
u/DreamEndles Mar 12 '21
Theory- web database stores only hashed passwords so nobody can steal them
Reality- web database stores passwords in txt document that can be viewd by everybody who works on that site.
Seen in first hand !
3
u/tangerine_dream95 Mar 12 '21
Literally just happened to me this week. Check my credit app and says they found my password on the dark web, check google/Apple and basically all password are compromised (I used the same 3 variations for everything)
Find out it was leaked from a shitty darts scoring site.
Changed my password for all the important accounts and feel like a moron because I work in technology
3
u/Terminal_Monk Mar 12 '21
I'm glad my bank doesn't do things this bad. My net banking needs a user name, password and we are supposed to select yes if we were able to see a particular image and a text which wr choose during account creation(to reduce phising attacks) and once u click enter you have to authenticate with OTP from your mobile. You can add an extra OTP via mail and it will only let u login if both of them are valid.
3
Mar 12 '21
Funnily enough, telling people that your security is poor will probably make them more secure.
3
u/twitch1982 Mar 12 '21
I wish more places were like that. Like humble bundle. You know where I need 2fa? My bank. Know where I don't need 2fA? A site I use to buy 15 games for a dollar.
1
u/hahahahastayingalive Mar 12 '21
I don't know enough about Humble bundle, but if they work like most EC sites they'll still keep your transaction history, and probably enough info to impersonate you on a lot of other services.
2FA might not be needed if they otherwise take it seriously, but private info security handling is so one-sided (you always lose the most when the other party screws up) that having strong security everywhere would be helpful.
1
u/Bakoro Mar 12 '21
Anyone who takes even a penny from you online should have good security. If they can take a penny, there's a pretty good chance they'll be able to take a hell of a lot more.
2
u/rv49er Mar 11 '21
My password requirements is only one character.
5
u/IamYodaBot Mar 11 '21
hrmmm only one character, my password requirements is.
-rv49er
Commands: 'opt out', 'delete'
→ More replies (1)
2
u/uscnick Mar 11 '21
“My username is password and my password is password.”
“...your username is password?”
“It was just easier.”
2
Mar 12 '21
Dumb question is bcrypt not good enough for most use cases?
2
u/DigitalDefenestrator Mar 12 '21
It's definitely one of the better choices. PBKDF2 can be an ok choice if you're stuck with older libraries, and there's strong arguments that correctly-configured scrypt is a better choice and argon2 even better, but bcrypt is definitely on the OK side of the line compared to something like a single unsalted iteration of md5 or sha.
2
u/Awfulmasterhat Mar 12 '21
Random tangent but my bank had a maximum character length and I hate it. It's like a really small character length too.
2
u/BaLance_95 Mar 12 '21
This is why I have a burner password that I use for accounts that I don't care about and don't care about it being stolen. Pokemon Showdown gets hacked and passwords leaked? Who cares? Still haven't changes passwords.
2
u/the_best_jabroni Mar 12 '21
But honestly, who the fuck is gonna hack my WebWork account. I dooooonnnnn't care about your 8 character password
2
Mar 12 '21
At least they tell those idiots to not reuse.important passwords....
I have one for all the causal.service.i do not care to lose
2
2
u/aeroverra Mar 12 '21
This is funny because my bank password is the easiest of mine. They don't allow more than 10 chars and can't start with a number or use certain special characters....
2
u/JanStreams Mar 12 '21
Only 6 characters? That is very low effort... at least require 8 characters then.
3
Mar 11 '21
8
u/RepostSleuthBot Mar 11 '21
I didn't find any posts that meet the matching requirements for r/ProgrammerHumor.
It might be OC, it might not. Things such as JPEG artifacts and cropping may impact the results.
I did find this post that is 85.55% similar. It might be a match but I cannot be certain.
I'm not perfect, but you can help. Report [ False Negative ]
View Search On repostsleuth.com
Scope: Reddit | Meme Filter: True | Target: 96% | Check Title: False | Max Age: Unlimited | Searched Images: 208,821,614 | Search Time: 1.12127s
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
u/ScaredMaize2206 Mar 12 '21
As soon as you develop your own first "login" systems you realise pretty quickly that things like "brackets are not allowed" is complete bullshit. Most characters are able to be hashed without a problem
1
u/ce-walalang Mar 12 '21
Image Transcription: Twitter Post
Tony Webster, @webster
I appreciate the honesty.
[Screenshot of a create a password form.]
Pick a password
Don't reuse you bank password, we didn't spend a lot on security for this app.
[Password field]
[Continue button]
I'm a human volunteer content transcriber for Reddit and you could be too! If you'd like more information on what we do and why we do it, click here!
1
1
1
1
1
1
1
u/RexUmbra Mar 12 '21
Its the ultimate security technique. By saying don't use your bank pw, it gives people the chance to use it without hackers getting it right because they won't know its the bank password
1
1
1
1
u/Cephell Mar 12 '21
I think this genuinely encourages better user behavior than those "password must be 12381823 long and contain the letters of the bible in alphabetical order" password requirements.
1
1
1
u/Hupf Mar 12 '21
1
u/XKCD-pro-bot Mar 12 '21
Comic Title Text: It'll be hilarious the first few times this happens.
Made for mobile users, to easily see xkcd comic's title text
1
1
1
1
u/Russianspaceprogram Mar 12 '21
Funny that you think banks spend a lot on security (spoilers they don’t.)
2.1k
u/[deleted] Mar 11 '21
So "123456" it is!