We’ve all been there.
I too love the Password game! Please save Paul! ~I truly care about him!~ Truly!
(Sorry, I sometimes like to post really bad comments…)
Haha this is great, got to the chess part before giving in
Same. My country was Jordan. Took way too long to figure out, because it dropped me in the middle of an empty amphitheater with no visible road signs, license plates, etc…
I just pasted all the countries and ditched the ones that were wrong.
Ah, dictionary based brute force attack. Classic.
Yup. I couldn’t figure out the answer from the network requests (that’s basically how I do the Wordle part of it) so I decided I’ll dump everything in there.
When I last played it I got dropped in a place where I had actually visited IRL (Uluru), made that part of the game easy
I’m starting to want to learn chess after learning about the password game. I need to go get further!
Qxh6
Bruh, it just made me google dork to find out where a random street view was. 10/10 would recommend
Have you been given the egg yet? Don’t forget to feed him!
I gave up at the ‘find a youtube video of an exact length’ step
my laziness limit had been reached
My Roman numerals should multiple to equal 35, but then the county I got starts with a C… how do you multiply by fractions in Roman numerals?!
You don’t need capital letters in the country name
Man, when I played, poor Paul got burnt to a crisp. I’m still having flashbacks from that shock.
Don’t you have to delete paul to win?
I haven’t known that one yet, hilarious :)
It was great until that step 20 where some ‘fire’ deleted everything I made. It’s one thing to make you think, it’s a completely different thing to just delete everything and make you start over. Fuck that noise.
I got stuck on rule 14 where I had to guess the country in Google maps.
Au2WonderfullyshellnIcepigsXXXV!85mayy4n6mfiend🌘
I guess it’s kind of secure. Does the password change daily with the current wordle word?
it does change a lot with every try
if you walk down the path like 20m there’s a sign that tells you where you are
I stopped playing when my whole password caught fire lmao
Thanks. I was only on my phone and didn’t feel like zooming in for that much.
“Sorry, that password is already in use” ruins it for me. That’s not a realistic message to receive.
Maybe “Your password cannot be one you’ve used previously”.
Should be: “your password cannot be one of your last 24 passwords”
Especially for those places that want your password changed every two weeks.
If they want to play that game - the calendar date becomes part of the password. It’s never the same, but you can always work it out!
Or just append a letter that increments every time you change your password, and keep a note of what the current letter is.
Passworda
Passwordb
Passwordc
…When your z password expires, just wrap back around to a.
It follows the vein of some of the password rules and feedback reducing security itself. Like why disallow any characters or set a maximum password length in double digits? If you’re storing a hash of the password, the hash function can handle arbitrary length strings filled with arbitrary characters. They run on files, so even null characters need to work. If you do one hash on the client’s side and another one on the server, then all the extra computational power needed for a ridiculously long password will be done by the client’s computer.
And I bet at least one site has used the error message “that password is already in use by <account>” before someone else in the dev team said, “hang on, what?”.
It’s true, most of these rules are harmful, but also most are in common use and accepted, for some reason. I have heard of a password system that had that warning, perhaps even the account, but it was in a softwaregore screenshot context.
Should say by who. :)
Now we are talking :)
It shouldn’t be.
But it is.
My favorite, though, is:
types in password “Password incorrect” goes to reset password “please enter a new password” types in password “your new password cannot be the same”
That just means you entered it wrong the first time.
It often means that one could have derived the correct password from the set of rules - but those rules are not shown when asking for the old password
Exactly this. I want to normalize showing the password requirements when you don’t immediately get the password - if you made me jump through hoops the first time, at least remind me what they were!
i have had this happen on some websites occasionally while using my password manager.
Sorry, that password is already in use
BIG red flag. Abort. Abort.
Also I love when they only support certain special characters. So the psuedo random noise created by my password generator won’t work until I curate out the unsupported characters.
I was changing my password on a pretty big company website the other day.
The password generated by my password manager kept giving me a http error (500 I think)
I generated a new password and deleted all the special characters other than the obvious ones. Boom, worked first time.
So looks like someone is not sanitising their inputs properly.
I sent them an email so hopefully they will fix.
Password1’); DROP TABLE Passwords;–
Robert’); DROP TABLE Students;–
I always just refresh the password until I get a random one without the characters the randomly choose to forbid 😂
For those wanting to play this as a game, there is this wonderfully fiendish website.
https://neal.fun/password-game/
Rule 13 Your password must include the current phase of the moon as an emoji.
Removed by mod
deleted by creator
The worst part is that if they know that password is already in use… then they aren’t storing their passwords appropriately.
You could store the passwords as hashes and just compare the hashed value.
yes, but then they are not salted, which is what they should be doing.
True, but for the same big O they can salt the password for each user and compare it to what they have stored. My big pet peeve (that I’ve actually seen) is when they say your password is too similar to an old one. I have no idea how that could be reasonably done if they’re storing your password correctly.
But are they peppered?
Good call.
Lol, at this point just generate a password for me to save in my bitwarden.
deleted by creator
Because it’s much more fun to come up with passphrases like Correct Battery Horse Staple.
It’s a lot easier to remember that than #@?Zk23!nPw
You are not supposed to have to remember anything but your master password. :)
deleted by creator
Tacking onto this, because I mix password types too, I don’t want all my passwords in the same (even pseudorandom) style.
Spoken like someone who has never had to deal with corporate ‘security’ before. Password managers are great, but if your workplace has incompetent IT (e.g. probs 90% of workplaces), then you’re SOL and must play the increments game.
Yeah, I switched from LastPass (after one of their many data breaches) to 1Password. I don’t know any of my passwords anymore because they’re all just generated and saved automatically. And that’s a good thing.
Tons of websites reject pseudo randomly generated passwords, too
deleted by creator
That’s inherently blocking pseudo random password generators.
Max length doesn’t bother me if it’s at least 128 characters, but only allowing specific special characters is a sin.
As of last year, Wells Fargo’s passwords were even cause insensitive. Dunno if they’ve fixed it since then, but probably not
Because I want control of my passwords in my head not some software, it’s not like a string of random characters is any more secure than one that can actually be remembered
deleted by creator
Yes because I have an easily remembered system for a unique passphrase for any given site. Not trying to shit on password managers though, just providing a different perspective
My favorite is when you forget your password and try to reset it but it cries that you can’t use passwords you already used
Mother fucker if I remembered what I used I wouldn’t be doing this
Thank you, I’m thoroughly annoyed.
Me too.
Fuck. I gave it a try for real this time and hit a permanent game over condition.
spoiler
Apparently you can overfeed Paul
Darn, I wanted to see what came next. Some of those rules were hilarious. But I’m not doing that all again.
That was my limit too!
I got to the “wordle” one before giving up. jesus lol, nice meme
Removed by mod
wow, spoilers /jk
The worst one is when it only supports up to like 16 characters but doesn’t tell you so it will only use the first 16 characters and ignore the rest. The next time you need to enter it and get the 64 character password from your password manager it will just say it incorrect and you’re left with no idea on why it’s wrong.
Holy shit you might have just explained why I have to reset my password every time for a local fast food joints own website
This was me on a bank’s site till I clued in that I need to shorten my password.
Why do you have an account for your local fast food joint?!
so he can get even faster food? idk
To order through their site, I try to use the places own sites instead of justeat etc so they get more of the money. As you can imagine they aren’t the best websites though.
You can’t just order per telefon?
I can do you one worse.
My banking app password was not case sensitive for many, many years. They finally fixed it a few years back though!
Sometimes there’s a limit on the length but it’s only imposed by the JavaScript of the website, so I can use my password manager to insert the text directly into the field but I can’t actually type it in.
😐
This has happened to me so many times. Frustrating and stupid being belief. Are they hiring 10 year olds to write the html/script? Sheesh.
deleted by creator
I think walmart.com was or is that way. Took me a while to figure that crap out.
Looks like someone’s been playing the password game https://neal.fun/password-game/
That game made me want to punch.
deleted by creator
Unfortunately a lot of jobs require passwords and they use outdated security processes, forcing people to have the old fashioned “must have uppercase, lowercase, number, and special character & you have to change it every 3 months for no reason” passwords instead of the stronger (and less annoying) alternatives.
i signed up at mba.com and it wouldn’t let me use a password because it contained a semicolon which wasn’t on the approved list of special characters, and then - get this - because I tried too many times to create a password - locked me out because I had “too many failed attempts”
Sounds like it’s prime time for a SQL-injection
Those requirements drive me crazy, especially because they’re all against NIST recommendations. Someone thinks they make passwords more secure but they have the opposite effect.
At any rate, password managers still help in those cases. If nothing else, for providing a safe place to record what your password is for when you forget it because of the dumb requirements.
I always wonder if such choices come from incompetent IT, or if IT wants to do things better but is banging their heads against corporate owners who think “more hassle = more secure”.
It’s almost certainly that writing security standards for an organization takes time and needs approval from high up. And someone high up complaining that they only just revised them to include special characters.
that’s exactly why a password manager works. there’s a generator that you can configure to meet requirements
Must be changed every month, can’t use a previous password, AND, for some fucking reason, can only contain 8 characters.
And if you forgot your password, you can call IT and they’ll just read it to you because they have them all saved somewhere.
That was a great place to work at.
Still frustrating. I generally try to make my passwords all lowercase in case I need to type them (especially on a phone). But a lot of places don’t allow that.
deleted by creator
If I’m typing on a computer keyboard, typing words is easier than random letters, but on a phone it doesn’t make much of a difference. What I end up doing is typing my passphrase into my password manager on the computer, and then typing the password on there into my phone.
I do have a password manager app for my phone, but then I have to type the whole passphrase into it so I don’t use it unless necessary.
This is one of the reasons why I am totally dependent on my password manager now.
I’ve seen this but with a final message of “Sorry, that password is already in use by user about2getOwned@gmail.com.”
- Login to their account
- Change their password to something else
- Set your password
But what if the password you want to set is already in use?
Refer to my above comment until that is no longer the case.
that password is already in use
lmao, “security” moment
Brute force user names instead of password. Big Brian moment
Large Brian Moment, for real
