@cdarwin@c.im2026-01-07 04:31:34
The curse of having to remember easily hackable passwords may soon be over
A new alternative is set to take over in 2026
#Passwords will be on the way out in 2026
as #passkeys take over
Warning: foreach() argument must be of type array|object, null given in /home/gartezitig/public_html/tootfinder.ch/inc/instance.php on line 222
@cdarwin@c.im2026-01-07 04:31:34
@metacurity@infosec.exchange2026-02-05 11:40:04
It's downright weird that McDonald's is leading a campaign to advise us to use more secure passwords.
McDonald's is not lovin' your bigmac, happymeal, and mcnuggets passwords
https://www.theregister.com/2026/02/02/mcdonalds_password_advice/…
@TFG@social.linux.pizza2026-02-09 11:19:11
TIL:
If you have your Samsung T7 Touch SSD encrypted with a password (and maybe a fingerprint) ..and you want to remove the encryption (or delete/change password/fingerprint).... Your device (MS Win) has to be connected to the internet. Otherwise the neccessary software just hangs after unlocking the SSD.
WTAF Samsung. For real.
This lead me to two questions:
1. What are the odds that passwords and fingerprints are casually transfered to some Samsung service? (Rhetor…
@kubikpixel@chaos.social2026-01-06 11:05:34
»Was ist Keycloak und was hat es drauf?«
Mit dem muss ich mich wirklich mal ernsthaft auseinandersetzen und nicht das Login "neu erfinden". Das Passwords so wie Passkeys jedes mal "neu" zu implementieren macht null Sinn. Cool wäre es, wenn Keycloak früher oder später auch PASETO & Co. integrieren wird.
🔐
@jdrm@social.linux.pizza2025-12-07 08:42:45
#FreeSoftwareAdvent KeePassXC is the best password manager I've used.
Can create strong passwords, store TOTP data, organize in folders all the keys, add comments...
@metacurity@infosec.exchange2026-01-23 11:42:28
149 Million Usernames and Passwords Exposed by Unsecured Database
https://www.wired.com/story/149-million-stolen-usernames-passwords/
@inthehands@hachyderm.io2025-12-25 03:32:53
My solution to the problem @… mentions:
1. Make password the •only• login field. No username/email! Just password, and you’re in!
2. Because they now identify users, passwords must to be unique across all users in a system.
3. For security reasons, require passwords to be unique across all sites on the entire Internet. A password can be used at most once in human history.
4. This renders account recovery impossible in many cases.
5. Over time, users are thus able to use fewer and fewer sites, eventually being forced offline altogether.
6. Success!
https://mastodon.social/@jwz/115776511391611416
@pre@boing.world2025-12-26 23:25:43
Like all the rest of the nerds, I did a bit of tech support on family computers.
They're all popping up windows from scam virus scanners lying that subscriptions need to be renewed or machines are unprotected. People don't know how to remove these things. Luckily they also don't really know how to pay the subscription.
Their phones are updating on them. Changing where buttons used to be. Removing options. Forcing people to register to use they things they have been doing for years.
They don't know how to register.
Things pop up asking for passwords and they have no idea who is asking or which password to use.
I tell them that I don't really understand why they keep using Windows now it is so shitty and awful. They say they don't know how to use anything else. The fact they don't really know how to use windows either doesn't seem to register.
The tech corporations have given up completely on being user friendly. They are all deliberately user hostile and exploitative now.
Corporate tech is terrible. The industry is failing it's users, abusing them. People don't even know there is any other way. They are just giving up on achieving their tasks until someone can fix the pop-ups and subscription boxes and passwords and 2fa for them.
Tech sucks now. Sucks hard.
#tech #christmasTechSupport
@thomasfuchs@hachyderm.io2026-01-27 21:56:05
So what’s good alternative to Firefox?
I need something for Windows and iOS and it should sync passwords. Ideally not Chromium-based and obviously no AI slop.
@teledyn@mstdn.ca2025-12-02 06:23:00
Content warning: re: intense Gnome frustrations no one should be forced to read
I have a theory: in my travels through various docs on various components I came across a strategy some apps use where they salt the encryption with the hash your current password. If any of these apps did that, moving .local files to the new machine would fail unlocking things because the passwords are different.
@ErikJonker@mastodon.social2026-01-30 08:07:43
Moltbot is like giving some stranger you can't really trust access to all your data, communications, passwords, your computer etc.. It is maybe fascinating but just don't do it..... The large AI players can already build this for a long time but there is a reason they are not doing it....
https://www.
@aredridel@kolektiva.social2025-11-28 16:19:02
Content warning: open source whinging
Ugh why is this always the way. I evaluated like 25 authentication servers for a small scale web project — I do want to support things like OIDC and Passkeys, so this is not something I really want to make myself like the old days of “use crypt() on the passwords and just make a simple database”.
5 of them are just dev mode garbage that will never see the light of day as a thing people use.
2 of them are home network nonsense for people who want enterprise login for their family, but where One Nerd controls the whole user-list.
15 of them are freemium "open source" where they withhold features for their enterprise tier and make them so unfortunately difficult to deploy, all requiring postgresql databases and a complex containerization setup and helm charts and oh so much.
and then there's kanidm, which is great except its opinions make it completely unusable for a community project, it's really more trying to fit the ‘enterprise unix authentication' space. Kudos to them for communicating it but it's the wrong tool, even if it is really good.
And then there's rauthy. Which is exactly what I want, well built and delightful, uses a lightweight embedded database, and even has a peer-to-peer sync for scalability. But customizing it is going to be a lesson in building it from source repeatedly, and its configuration is just a bit strange, and its frontend is extremely Backend Developer Wrote A Web UI. I guess I got a second project. And maybe a third to make debian packages of it.
Yet it really is the best of the options _by far_.
NLNet supported projects continue to punch above their weight class.
@gray17@mastodon.social2025-12-31 07:35:04
for per-contact email, I've settled on Proton Pass, $36/yr (free is limited to 10)
under the hood it's SimpleLogin, an email proxy, rewrites from/to. sometimes has problems with antispam, but them solving it is better than me.
Proton acquired SimpleLogin in 2022, and made it a subfeature of Proton Pass (not Proton Mail)
yes it's weird to tie this to a password manager. no the proxy doesn't get to read your passwords. yes the Proton CEO is weirdly problematic…
@metacurity@infosec.exchange2026-01-23 16:25:56
Before you head out for the weekend, don't miss today's Metacurity for the crucial cybersecurity developments you should know, including
--A database with 149 million usernames and passwords was exposed on the internet,
--Venezuelan nationals who stole cash from ATMs using malware will be deported from US,
--FBI asked Microsoft to unlock encrypted laptops,
--Under Armour is investigating massive data breach,
--Tech investors want the US government to prob…
@philip@mastodon.mallegolhansen.com2025-12-16 23:57:34
@…
So to reiterate this conversation:
You: Passkeys don't have problems A, B, C and D!
Me: Actually B is still a problem.
You: Yeah well, B is also a problem for passwords! And so is F and G!
Me: Yes, but B is still a problem.
You: But if I hacked the pentagon, then Z would also be a problem for passwords!
I'm not a…
@kubikpixel@chaos.social2025-11-20 06:05:41
100k most used passwords
These are the latest 100k most insecure used (hacked?) passwords. I wonder why at least a minimal regex the first hurdle can stand in the way of the attackers, i.e. apparently has not yet been widely implemented? Am I wrong, or are there reliable sources?
💥
@hanno@mastodon.social2026-01-14 10:56:48
I wish @… would go back to providing the pwned passwords list as a simple download and not require a weird tool that I have to deal with...
If someone wants to provide a service: Provide something like quarterly dumps of the list as a download.
@jom@social.kontrollapparat.de2025-11-21 11:21:33
@nemobis@mamot.fr2025-12-16 14:23:34
I understand it's fashionable to disable password login and instead force people to retrieve one-time passwords from their mailbox. This works better if you first verify that you can actually deliver #email to your users. (Totally random thought definitely not inspired by real events.)
@ErikJonker@mastodon.social2025-12-26 17:46:23
“you can just supply an IP address of a MongoDB instance and it’ll start ferreting out in memory things such as database passwords (which are plain text), AWS secret keys etc. The exploit specifically looks for those class of credentials and secrets, too.”
https://doublepulsar.com…
@grumpybozo@toad.social2026-01-17 15:59:55
I spent Friday trying to hack into a customer box in India. They need support but have "secured" the system beyond the reach of the access mechanisms they have offered. None of the 4 different VPN’s we operate for their US operations can reach the box directly, so I must RDP into a domain controller in Mumbai, which they replaced without telling us. After finally getting to the box, none of the dozen passwords they’ve provided over the years work.
Definitely billable hours. <…
@adamhotep@infosec.exchange2026-01-14 02:26:38
The only way to handle #passwords is a password manager. @… (free, open source), @…
@Stomata@social.linux.pizza2025-12-18 11:29:29
@… hey, need a little help. I recently created a accounts on fedi.absturztau.be @…. I massed up my keepass databases and lost access to passwords. I haven't logged in to
@timjan@social.linux.pizza2025-11-12 06:18:38
"Your email and password has been pwned in this leak. You should change the affected password"
Thanks, according to my password manager, there are about 50 different passwords associated with services where I signed up using this particular email address.
(Yes I know, create unique plus addresses - except this somewhat geriatric service doesn't do plus addresses, and besides, not all websites accept them)
I wonder which one I actually need to change. If I n…
@thomasfuchs@hachyderm.io2025-11-14 16:57:18
So what's a good alternative to Firefox (I'm using it when I'm not on my Mac). I don't want their new "AI Window" stuff and I don't want to support it.
It has to work on Windows and an iOS version as well, and can sync passwords between those.
Please only suggest things you personally use and like.
I'm ruling out Chrome (spyware) and Brave (homophobic owner).
(Wish Apple would still make Safari for Windows.)
@grumpybozo@toad.social2025-12-11 18:37:40
Unclear to me why no one ever mentions Strongbox in #PasswordManager reviews. It is a perfectly fine PM for macOS/iOS/iPadOS that has a rich set of sync options, most of which don't involve any 2nd/3rd party storage. It stores its databases in KeePass2.x (kdbx v4) format, so it is data-compatible with the many variations of KeePass.
(I use it with SSH/SCP sync, so as long as I’m at…
@ErikJonker@mastodon.social2026-01-30 08:07:43
Moltbot is like giving some stranger you can't really trust access to all your data, communications, passwords, your computer etc.. It is maybe fascinating but just don't do it..... The large AI players can already build this for a long time but there is a reason they are not doing it....
https://www.