A forum for discussing and organizing recreational softball and baseball games and leagues in the greater Halifax area.
Reminder to use strong passwords
-
Just got done investigating a spambot we had earlier, and it looks like they used a lot of compromised accounts on other instances to give their post an initial upvote boost. If you don't already, please remember to use a good strong password. Keeping your account secure helps reduce spam across the whole of lemmy, and keeps your account from getting banned for things you didn't actually do. I recommend [Diceware](https://theworld.com/~reinhold/diceware.html) I use it in my professional capacity as an IT/Security person, and also you get to use your mathrocks!
-
I like the CorrectHorseBatteryStaple methodology. https://xkcd.com/936 !https://imgs.xkcd.com/comics/password_strength.png
-
Password managers are OK but I have hesitations on them personally. I'm leery of putting all my most high-value stuff in one place behind one password. What I do instead is memorize a truly unreasonable amount of passwords, though, which I recognize is not a reasonable expectation for others. For threat models in which you're not worried about in-person attacks, it may actually be a good idea to just write your passwords down, maybe keep your password book in something with a lock on it. I'm not advocating for any particular method, just putting it out there so people can make an informed decision.> I'm leery of putting all my most high-value stuff in one place behind one password. Most password managers can be set up to also require a keyfile and/or physical passkey to unlock their databases. A keyfile means someone couldn't get into your password database even if it got leaked and they knew the password (assuming you stored your keyfile separate from the database - the file and its location should be treated like a password itself), while a physical passkey makes it virtually impossible to breach the database unless someone steals the USB device.
-
Just got done investigating a spambot we had earlier, and it looks like they used a lot of compromised accounts on other instances to give their post an initial upvote boost. If you don't already, please remember to use a good strong password. Keeping your account secure helps reduce spam across the whole of lemmy, and keeps your account from getting banned for things you didn't actually do. I recommend [Diceware](https://theworld.com/~reinhold/diceware.html) I use it in my professional capacity as an IT/Security person, and also you get to use your mathrocks!Over the years, nobody has ever guessed my passwords, but four sites I was subscribed to were compromised and my email+password got leaked anyway. The strongest chain and the weakest link...
-
> I'm leery of putting all my most high-value stuff in one place behind one password. Most password managers can be set up to also require a keyfile and/or physical passkey to unlock their databases. A keyfile means someone couldn't get into your password database even if it got leaked and they knew the password (assuming you stored your keyfile separate from the database - the file and its location should be treated like a password itself), while a physical passkey makes it virtually impossible to breach the database unless someone steals the USB device.I guess what I mean is, it's a single point of failure. Usually an extremely strong one, granted.
-
these are called pass *phrases* and yes, they tend to be way more secure at least until quantum computers render all traditional cryptography meaningless.
-
Well good news then, because even throwing every quantum computer currently on the planet is not enough to factor 2048-bit RSA, and likely won't be in any currently alive human's lifetime.Maybe with *current* quantum computers, but human technology tends to increase at an exponential rate so I doubt it will be long. Scientists are already trying to design post-quantum encryption for this very reason. https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
-
I guess what I mean is, it's a single point of failure. Usually an extremely strong one, granted.
-
these are called pass *phrases* and yes, they tend to be way more secure at least until quantum computers render all traditional cryptography meaningless.
-
Basically what diceware does. It's just that humans are really bad at picking random words ("banana" is over represented, for instance) that's what diceware helps with.
-
> until quantum computers render all traditional cryptography meaningless. I'll cross that bridge when it actually happens.You’ve got an estimated 5-10 years before quantum computers can crack all current encryption by using Shor’s algorithm. > One of the most important quantum computing algorithms, known as Shor's algorithm, would allow a large-scale quantum computer to quickly break essentially all of the encryption systems that are currently used to secure internet traffic against interception. Today's quantum computers are nowhere near large enough to execute Shor's algorithm in a practical setting, and the expert consensus is that these cryptanalytically relevant quantum computers (CRQCs) will not be developed until at least the 2030s.
-
Not recommended. People can and do crib the kinds of things you're likely to have around you. It can narrow the field of guesses more than you'd think.
-
Well, no, not really. If I forget a password I've only lost access to the one site, and it's recoverable. Just an incremental failure. Not going to lose everything unless I literally die in which case I don't care about anything anymore. And no one is going to breach my brain short of tying me to a chair, and that's not really my threat model.
-
Well, no, not really. If I forget a password I've only lost access to the one site, and it's recoverable. Just an incremental failure. Not going to lose everything unless I literally die in which case I don't care about anything anymore. And no one is going to breach my brain short of tying me to a chair, and that's not really my threat model.
-
Password managers are OK but I have hesitations on them personally. I'm leery of putting all my most high-value stuff in one place behind one password. What I do instead is memorize a truly unreasonable amount of passwords, though, which I recognize is not a reasonable expectation for others. For threat models in which you're not worried about in-person attacks, it may actually be a good idea to just write your passwords down, maybe keep your password book in something with a lock on it. I'm not advocating for any particular method, just putting it out there so people can make an informed decision.
-
we want you to have a secure password so we're only letting you use letters, numbers, and !@#$. nothing else. also, you have to use at least one of each, and it can only be 8 to 12 characters long. remember, we're doing this for your security!
-
Ideally all lowercase letters to make them easy to type when you need to use them in another device. Unfortunately, a lot of places don't allow that, preferring less secure and more inconvenient passwords.30 characters? you don't need that, we only let you use up to 10. also yes you have to have at least one lowercase letter, uppercase letter, number and a symbol (which can only be !, @, #, or $). we're doing this for your security, of course
-
Just got done investigating a spambot we had earlier, and it looks like they used a lot of compromised accounts on other instances to give their post an initial upvote boost. If you don't already, please remember to use a good strong password. Keeping your account secure helps reduce spam across the whole of lemmy, and keeps your account from getting banned for things you didn't actually do. I recommend [Diceware](https://theworld.com/~reinhold/diceware.html) I use it in my professional capacity as an IT/Security person, and also you get to use your mathrocks!@sirblastalot@ttrpg.network It seems that my (current) main account was banned as part of that cleaning. Can you or another moderator let me know what's the process of appealing this ban ? Or shall I take-it as an opportunity to move my main account to piefed ?
-
@sirblastalot@ttrpg.network It seems that my (current) main account was banned as part of that cleaning. Can you or another moderator let me know what's the process of appealing this ban ? Or shall I take-it as an opportunity to move my main account to piefed ?DMing you
