Why do so many companies and people say that your password has to be so long and complicated, just to have restrictions?

I am in the process of changing some passwords (I have peen pwnd and it’s the password I use for use-less-er sites) and suddenly they say “password may contain a maximum of 15 characters“… I mean, 15 is long but it’s nothing for a password manager.

And then there’s the problem with special characters like äàáâæãåā ñ ī o ė ß ÿ ç just to name a few, or some even won’t let you type a [space] in them. Why is that? Is it bad programming? Or just a symptom of copy-pasta?

  •  janAkali   ( @janAkali@lemmy.one ) 
    link
    fedilink
    English
    1
    edit-2
    1 year ago

    While most of the time, I remember my password, I know I could just snap and forget it right there at any point. Happened to me not once. And I’m in my 20s. Sometimes when I forget a password, I just start typing and muscle memory kicks in, sometimes it doesn’t. I guess our brains are not optimized to store long random strings of characters. You could use a long sentence as your master password or do as I do:

    Come up with a way to make up a long seemingly random password from a couple words. Then if/when you forget a password, just remember those words and reconstruct password from them.

    • Don’t use common dictionary words or anything from popular media, as it could be guessed by attackers.
    • You can write down algorithm on a piece of paper and keep it somewhere safe.
    • Words should be related but not directly:
      • two asteroid names - bad
      • asteroid name and it’s greek translation - bad
      • real city name and city name from a book - good
      • two words that both start with S and end with T - good
    • If you forget both words, you should be able to remember/look up at least one of them if you still remember how you came up with the word.
    • I used a passphrase generated from a word, kinda like an acrostic poem.

      Exmaple: LEMMY

      Lemonade Endeavor Makes Melons Yellow

      I know the word that I used to generate my passphrase, I’m just missing one word of the passphrase, but I know the starting letter.

      I could theoretically “brute force” all the words that starts with that letter, but I’m just too depressed and unmotivated to solve a captcha for each guess. Maybe I’ll find the missing word, but it could take months.