It turns out that emoticons are considered a symbol, so they can beef up your passwords and make them more secure in combination with letters and numbers. Here’s how.
        • Jolteon@lemmy.zipEnglish
          3·
          11 months ago

          But why wouldn’t it make sense to need to pull the cab off of a pickup truck to change the spark plugs?

        • El Barto@lemmy.worldEnglish
          21·
          11 months ago

          That’s true for all car designers. You’re referring to the shitty designers, though.

          Architects don’t get involved in the actual construction of a building either.

          • Echo Dot@feddit.ukEnglish
            5·
            11 months ago

            Oh they do. They come to tell you that the safety protocols you’ve implemented are interfering with their design.

            They’d prefer it if it looked pretty and then just fell down and light breeze thank you very much

    • Cavemanfreak@lemm.eeEnglish
      52·
      11 months ago

      All the apps I’ve used recently use QR codes (or similar measures, like a sync code) that has you log in from the phone, so it should work anyway!

      • kratoz29@lemm.eeEnglish
        3·
        11 months ago

        But not all apps, sadly, I just experimented it with Crunchyroll, and saw my dad struggling with a crappy app called Vix yesterday.

      • Echo Dot@feddit.ukEnglish
        2·
        11 months ago

        In my experience the only one that works with any degree of reliability is YouTube. Even the Netflix one can be fairly intermittent.

        Also a lot in the time you’ll go away and the hotel you’re in will have a smart TV and the software was last updated in 2011 so you have to sign in on the device.

      • lolcatnip@reddthat.comEnglish
        51·
        11 months ago

        I’ve had to manually type in passwords on a TV several times in the last few months because sometimes the login for even the biggest brand-name services is just broken.

    • fosstulate@iusearchlinux.fyiEnglish
      4·
      11 months ago

      Two of my colleagues still use locally stored plaintext for individual work credentials, despite having been shown where the password manager is. Both have accessed their files in front of me. If it’s not in those files it’s saved in the browser (because convenience is a hell of a drug). Now you start to see why discrete managers have a hard time, even amongst technology workers.

    • vamputer@infosec.pubEnglish
      162·
      11 months ago

      I like doing entire phrases with some rhymes thrown in. Makes it easier to remember them.

      “BonyTonyMoansHe’sOnlyGrownLonely” has a shitload of characters, and a full sentence (even a nonsensical one like that) is more memorable to me than a random handful of disparate words.

      The more ridiculous, the better. (And, naturally, don’t forget your numbers and symbols)

      EDIT: Actually, no idea why I made it all one group of words. So long as spaces are in the password’s character space (and they very well should be if friggin’ emojis are), there’s nothing stopping you from doing an entire, punctuated sentence- other than that we’ve been conditioned not to think of a password that way.

      “Skinny Kenny’s friend, Mini Ben, has 20 chins.” That should be a fully-acceptable password with 46 characters (48 if you add the quotes), capital letters, numbers, and special characters.

      • scinde@discuss.tchncs.deEnglish
        4·
        11 months ago

        You can’t compare a 46 random character password to a password composed out of words, the entropy of each is very different. Your kind of password is vulnerable to dictionary attacks which are way more common and easy than brute forcing every possibility. A 50+ characters unique random password for each service that is stored in a password manager which is encrypted with a 20+ characters random password is the most secure and future proof (for now).

        • Aatube@kbin.social
          41·
          11 months ago

          If the attacker doesn’t know that you’re using a dictionary password, then dictionary attacks probably won’t be their first choice. I want to remember these passwords across devices and on guests.

          • scinde@discuss.tchncs.deEnglish
            5·
            11 months ago

            Like someone else said on this thread; that’s just security by obscurity, which is bad. Dictionary attacks will be one of the first (brute force related) attacks attackers will use because word passwords are incredibly popular (though admittedly of fewer words: VeryBigDog34 etc…), and relatively easy to do. I agree that having the password across different devices is somewhat of a challenge with a password manager, but not impossible. My very long and complex password is all down to muscle memory by this point, I couldn’t tell you what it is from memory.

            Also you shouldn’t use the same password on multiple things and if you don’t use a password manager you will need to memorize a lot of different passwords.

        • ferret@sh.itjust.worksEnglish
          1·
          11 months ago

          Dictionary attacks aren’t some magic bullet. There are a lot of english words and just four of them IS comparable in cracking difficult to a standard 8-char password that is as random as you can make it. There are a lot more words than there are symbols. Four words is obviously not as good as 46 totally random chars

          • scinde@discuss.tchncs.deEnglish
            1·
            11 months ago

            Dictionary attacks are definitely not a magic bullet, they require a lot of processing power, just like any other brute-force attack, but not more because of their longer length, as has been implied.

            True, there are a lot of english words, but the amount of common words is relatively small. Most people aren’t going to choose a password like “MachicolationRemonstranceCircumambulationSchadenfreude”, even if it were generated for them (which is unlikely).

            Sure, it is comparable to a standard 8 characters passward, but even that kind of password is verging on the insecure (it is the absolute minimum, which should be avoided when possible).

            There are also a lot of symbols when you count emojies and the entire Unicode standard.

    • Lupec@lemm.eeEnglish
      10·
      11 months ago

      I love it, Bitwarden has supported generating passphrase style passwords for a while and it’s basically that. It’s my go-to these days.

      • El Barto@lemmy.worldEnglish
        51·
        11 months ago

        Got a source on that?

        Edit: plus brute forcing is just one scenario. I think the xkcd comic refers to using passwords in online services, and those usually have some sort of rate limiting.

    • JigglySackles@lemmy.worldEnglish
      105·
      11 months ago

      Just be sure to throw in symbols and numbers to beef it up. Dictionary words are easier to brute force.

      • djdadi@lemmy.worldEnglish
        54·
        11 months ago

        Not 4 of them in a row. Keep in mind the attacker doesn’t know " look for exactly 4 words"

        • Killing_Spark@feddit.deEnglish
          51·
          11 months ago

          That’s just security by obscurity. It’s one other strategy of choosing passwords that a bruteforce attack is going to try if it gets popular

          • lolcatnip@reddthat.comEnglish
            11·
            11 months ago

            That’s not what security by obscurity means. And going by your definition, all passwords are security by obscurity.

            • Killing_Spark@feddit.deEnglish
              1·
              11 months ago

              If your strategy is to just use dictionary words your password will have little entropy and even less so if you use grammatically correct sentences. If the attacker knows this is your strategy of choosing passwords cracking one is way easier than cracking a password that has the same length but consists of randomly chosen characters.

              Your password is only safe because the attacker doesn’t know your strategy of choosing the password which forces him to use inefficient methods of cracking it, while there would be a more efficient way if he knew the strategy you used. Which is security by obscurity.

  • Dizzy Devil Ducky@lemm.eeEnglish
    5219·
    11 months ago

    I’d rather staple my forehead to a telephone pole before I ever think about using an emoji in a password. Those things are abominations!

    • snek_boi@lemmy.mlEnglish
      221·
      11 months ago

      Out of curiosity, what makes you say so?

      Edit: Oh. Did a “Wooosh” happen to me right now? Are you being ironic and referring to the XKCD thing about how to make a secure password using words in phrases?

      • El Barto@lemmy.worldEnglish
        132·
        11 months ago

        I think OP is conflating the use of emojis in passwords with the use of emojis by the general public.

        Yes, it’s annoying to read stuff like “Hi 😃😃😃😃 I am Bob ♥️♥️♥️😎😎😎😎,” but that doesn’t mean that using them in passwords is a bad idea.

        • xor@lemmy.blahaj.zoneEnglish
          2·
          11 months ago

          Or that “hi 😊 I’m Bob” doesn’t express a (subtly) different meaning to “hi, I’m Bob”

        • Valmond@lemmy.mindoki.comEnglish
          34·
          11 months ago

          Well they have to be the same on different devices, like you log in to Lemmy on your PC and then on your phone. Also sometimes it seems the icons change, or there are new ones and maybe old ones are removed …

          • El Barto@lemmy.worldEnglish
            12·
            11 months ago

            Emojis are standardized. They may look different in different devices, but the code of a “raised hands” emoji will always be the same, just like the code for A is always the same.

            Removing old ones could be a problem, though.

            • Corkyskog@sh.itjust.worksEnglish
              5·
              11 months ago

              What if I am using a device that doesn’t support emojis? wouldn’t I need to learn the code for each emoji I have used in a password?

              • El Barto@lemmy.worldEnglish
                5·
                11 months ago

                That’s a good question, and yeah, I guess you’d either avoid using emojis or accept the fact that they’re not universally supported.

                Having said that, some people use non-ascii characters in their passwords, such as Œ which is a valid letter in some alphabets, and they’d run onto the same issue.

              • Honytawk@lemmy.zipEnglish
                3·
                11 months ago

                Yes

                But how many modern devices don’t somehow support emojis though?

                And how many of those you need to enter a password in?

            • Droechai@lemm.eeEnglish
              23·
              11 months ago

              Just like a gun is standardized to a water gun for some and a real gun for others?

              Edit: I get your point, ita just if you memorize your password with emoji icons different icons would screw up your tries to log in

              • El Barto@lemmy.worldEnglish
                4·
                11 months ago

                If you search for “gun” in your device when selecting an emoji, just pick whatever comes up. Done.

  • BrianTheeBiscuiteer@lemmy.worldEnglish
    28·
    11 months ago

    Sounds great where it works but I’m sure most systems would reject an emoji or make you type out some overly complex password in addition to your emoji.

    • Toribor@corndog.socialEnglish
      12·
      11 months ago

      Honestly you’d be surprised how many places it just works magically. I was surprised to find that Office365 users could use emojis in names for Microsoft Teams which had no problem syncing those accounts back to an on-prem Active Directory. You can use emojis to name a whole SQL database, let alone users/passwords on it.

      I keep wondering if I need to figure out how to turn that off but it hasn’t caused any problems. It’s definitely sketchy looking though when you see a bunch of normal usernames and then suddenly one is just ten snowman emojis in a row.

      • Honytawk@lemmy.zipEnglish
        81·
        11 months ago

        Emojis are just a string of special characters that get recognised and replaced by an image anyway. It is the same as using those special characters separately.

    • Echo Dot@feddit.ukEnglish
      8·
      11 months ago

      It’s all just Unicode so in theory a password system shouldn’t think that emoji or any more interesting than any other character. To a computer the letter B and the emoji ✈️ equivalent in that they’re both just normal characters that one can type.

      Sort of, emoji are usually treated as two or more normal characters so ✈️ might be equivalent to BB. But the basic point is the same.

    • pewgar_seemsimandroid@lemmy.blahaj.zoneEnglish
      181·
      11 months ago

      💀💀💀💀💀💀💀🗿🗿🗿🗿🗿🗿🗿🚣👍👍👍👍👍👍🔥🔥🔥🔥🔥🔥🔥 sigma

      the emojis and text above are a part of the reason

    • ArxCyberwolf@lemmy.caEnglish
      17·
      11 months ago

      People who use them tend to spam the hell out of them. Like, 8 of the same emoji. And they use them every other sentence. It’s obnoxious, you only need one or two to get the point across.

    • xthexder@l.sw0.comEnglish
      174·
      11 months ago

      Back in my day we only had 95 printable characters, and that’s the way we liked it! /s

    • Polar@lemmy.caEnglish
      2817·
      11 months ago

      Antisocial people.

      It was the same on Reddit. All of the people who despised emojis were often posting in really cringe and incel related subs.

      My use of emojis sky rocketed after I started dating. They are fun and convey emotion really well.

      • Honytawk@lemmy.zipEnglish
        102·
        11 months ago

        I’m convinced emojis are what has been missing from language for a long time. They are great way to portray emotions through texts, which otherwise could not be achieved.

        This way there is a difference between:

        “You are so amazing 😁👍”

        and

        "You are so amazing 🙄 "

        • mbp@lemmy.sdf.orgEnglish
          4·
          11 months ago

          If I’m going to be relaying through to people strictly over text as much as I do these days, I better have a way to articulate it with the right emotional range to match my sparkling personality ✨

    • schnurrito@discuss.tchncs.deEnglish
      2·
      11 months ago

      They didn’t exist yet when I was an early teenager, all we had were emoticons that might be replaced by images by the forum software, so of course I think they’re stupid /s

      Without sarcasm, it is a good thing we have standardized symbols now and don’t have to implement emoticon replacement into forum or chat or social media software. If only because half of such implementations replaced any occurrence of the number 8 followed by a closing parenthesis with 😎 even when that wasn’t the intended meaning (one can think of many other times one would end a parenthetical statement with the number 8).

  • Treczoks@lemm.eeEnglish
    17·
    11 months ago

    Completely useless from many sources where I have to rely on a keyboard for entering passwords.

  • Cosmos7349@lemmy.worldEnglish
    17·
    11 months ago

    As a software developer who has worked with a lot of symbols and emoji… PLEASE DON’T DO THIS.

    Software doesn’t all handle these symbols the same way, and without tech knowledge (or even with) , it’s very possible to not be able to log in easily. I’m kinda drunk rn, but I’ll try to explain as simply as I can…

    For example… skintone emojis are actually two characters, a face and a skin tone modifier. I think those ones are always two characters but some of these “multi-char” characters can be normalized into a single character. But not everyone handles this the same way. For example, Safari might normalize the emoji, but Firefox might treat it as two separate characters… And this would probably make your password not match. But basically… text has lots of edge cases; I’d advise to use normal passwords please (also maybe a password manager)

    • banneryear1868@lemmy.worldEnglish
      71·
      11 months ago

      Was gonna say… you’re relying on the consistency of external emoji handlers that you don’t control. Ascii emojis are one thing.

        • banneryear1868@lemmy.worldEnglish
          21·
          11 months ago

          It was pretty normal lol. Basically everything between the visual of an emoji and what “text” is entered is not in your control. So it’s great for security but not in practice as a password. What brand was the kombucha I want some.

          • Cosmos7349@lemmy.worldEnglish
            3·
            11 months ago

            I didn’t realize NYC has a physical Juneshine location. So I got a flight… and a Juneshine cocktail…

    • StarDreamer@lemmy.blahaj.zoneEnglish
      2·
      11 months ago

      Thanks for the feedback! I’ll be sure to use non-printing characters instead of emojis for my passwords! (They can’t guess it if it’s invisible right?)

      In all seriousness, why are people so adverse to using password managers? People are plenty willing to use the browsers built-in “remind my password” instead of a proper password solution such as bitwarden… And they come up with such “hacks” just to avoid using a proper length password.

  • SirEDCaLot@lemmy.fmhy.netEnglish
    131·
    11 months ago

    Last week or two I’ve been learning more about passkeys, and it makes threads like this seem ridiculously out of date. Given the choice between emojis and passwords and hard crypto, I’ll take the crypto.

    • Kusimulkku@lemm.eeEnglish
      2·
      11 months ago

      I’m not sure what the passkey advantage over long unique password in a password database is.

      Well, KeepAssXC just got passkey support so I guess it doesn’t matter much

      • lemmyvore@feddit.nlEnglish
        5·
        11 months ago

        With passkeys, your browser and the website exchange a public-private key pair then make up long random one-time “passwords” every time you login but only use them to check they each still have the right key.

        • Kusimulkku@lemm.eeEnglish
          2·
          11 months ago

          I guess I’m gonna need the answer spoonfed to me. I think I understand how the tech works but I don’t understand the advantage over a complex non-reused password. Maybe keyloggers, if it’s one-time thing?

          • coffinwood@feddit.deEnglish
            4·
            11 months ago

            The advantage - from my very incomplete understanding - is that your passkeys cannot be phished or stolen from you. So only you from your device can log-in to the site. Which leaves me with the question, how cross-device passkeys work.

            • ricecake@sh.itjust.worksEnglish
              3·
              11 months ago

              There are different ways.

              One way is to use an encryption module on the device that, rather than storing the keys just encrypts the keys and holds an encryption key that you can’t extract, and can do various crypto operations.
              Now you ask the module to do a secure key exchange algorithm with the new device, meditated by a party the module trusts, like apple or something.
              Now both devices share a secret key, and they trust that the other is owned by the same user because the owner verified with apple who then signed the exchange messages.
              Old device decrypts with the old key, and encrypts with the new key, never letting the data leave the secure module. Send the data to the new device which can do the reverse, and both devices forget the shared password.

              Overall, minor weaknesses like storing keys in the cloud encrypted by a key derived from a password that the cloud never sees, while objective weaknesses, are still significant net improvements to security over passwords.

              • coffinwood@feddit.deEnglish
                2·
                11 months ago

                Thank you for explaining. That’s a thing most sites leave out: tell people how the keys cannot be stolen while still working on a different device.

                • ricecake@sh.itjust.worksEnglish
                  2·
                  11 months ago

                  Big reason for that is the spec for how this all works being around for a while, giving people a lot of time to write about the core of how it works, but the viable popular implementations are far newer, so articles still haven’t been updated, and doing the key transfers is still one of the newest parts that the big vendors don’t want to talk about yet, because they still have to get their patents fully approved and everything.

                  What I described above is one way to move data between two devices in a secure way with a trusted intermediary to verify identity, but I have no idea if it’s how any major vendor actually does it, because they haven’t made that data public. It’s just what’s obvious to a sufficiently informed subject matter expert.

            • Kusimulkku@lemm.eeEnglish
              2·
              11 months ago

              That would be a really nice advantage but yeah, I wonder how cross-device passkeys or recovery passkeys would work

          • lemmyvore@feddit.nlEnglish
            3·
            11 months ago

            There are lots of advantages:

            • No need to worry about password encoding, like this emoji debacle for example. Actually there’s no need to worry about passwords in general anymore, no more worries about lenghts, encoding, character space, remembering them etc.
            • It eliminates that scam where attackers set up a site on a domain that looks like the correct one, because the domain is part of the protocol.
            • It eliminates phishing for 2FA because login only works on your device anyway and there’s nothing you can be tricked into giving away to an attacker.
            • If attackers break into a site and steal the public keys they can’t use them for anything.
            • Since the whole process is automated between servers and browsers and also standardized, it can be upgraded seamlessly and continously, you can upgrade the protocol, the key lengths, the encryption cyphers etc. with zero impact for the user. New upgraded versions can be distributed to both servers and browsers and they’ll just use the highest version they both have.
            • 2FA is a core part of the protocol, but again in a way that eliminates phishing: it’s basically a way to unlock access temporarily to one specific key in your key vault. You can use a master password, or an USB key, or TOTP codes, or biometrics (fingerprint or face) etc., but NOT cellular texts (SMS) anymore because the vault stays on your devices, no need for another party to send you anything.
            • Syncing your vault online and over multiple devices, as well as backup, are also a core part of the approach and will eliminate the worry that you drop your phone and you’re screwed forever.

            The downside is that there’s been a whole bunch of tools and apps and services built around passwords for decades and converting all that mass to passkey tools will take a bit.

            There are some other tradeoffs like, right now for example I can reasonably print all my passwords and TOTP codes on a few sheets of paper and achieve an “offline” backup in case of untimely death and so on, it’s going to be a bit more cumbersome with passkeys. But I expect there will be ways to optimize that as the technology evolves.

          • ricecake@sh.itjust.worksEnglish
            3·
            11 months ago

            Passkeys, under the hood, use a way of proving your identity that doesn’t require you to actually send your password, and also doesn’t require you to send your username either.
            Because of how it’s implemented, the system managing the passkeys also gets to authenticate that the website is who it says it is.

            So no private data actually gets sent anywhere, but you can prove your identity while also checking the identity of the site you’re talking to, like the SSL lock icon but automated. It’s often implemented such that the device that holds they keys can’t actually have them stolen from it, and it’s integrated with a biometric sensor.
            This means it’s possible to have a high degree of confidence that the person logging in is physically the same person who created the credential, and not just someone who had their password stolen.

            The final perk, is that if you’re using something like a phone with a fingerprint scanner, passkeys work as two factors of authentication, despite only feeling like one.
            Because the phone verifies your identity via fingerprint (something you are), it can then unlock the key that is uniquely available to the phone (something you have).

            Combine that with being generally easier to use, and it’s pretty clear why most security experts are pushing them. Security that users will use is better than security they won’t, and finally we have easier to use security that’s also better than the more difficult options.