It turns out that emoticons are considered a symbol, so they can beef up your passwords and make them more secure in combination with letters and numbers. Here’s how.
The website should feed your password straight into a well known hashing algorithm or key derivation function that has undergone a decade or more of careful scrutiny, without any other processing. The output will usually be a fixed length base64 or hex string.
There's a short list of about three options that are currently considered acceptable, and a few more are probably fine but are a little too easy to crack these days (e.g. anything that shares the same math as bitcoin... what if someone throws a mining datacentre at your password?)
If the site breaks, maybe you don't to be a customer of that service.
It's not the processing on the server that's the problem. To reach the server the password needs to go through several layers of character encoding, if any of them fails the server will receive something different from what you meant. And when you try to login from another device and the layers will be different you'll effectively be sending a different password.
Sounds like a crappy implementation of the authentication server then, and the sysadmin deserves a paddlin' for not stripping non-UTF characters (or making sure they work).
My problem with using emojis as part of the password would rather be that while I might be able to enter them on my personal Android phone using the exact keyboard app I have installed right now, I might find myself struggling on a desktop computer or any other phone that doesn't have this exact keyboard installed. After all, the graphical representation of the same emoji might look different there, and there is a chance I couldn't even recognize it.
So if anything, I'd say use a non-UTF keyboard like Thai or Chinese, but then a standard character in that specific type. Keyboards layout can be installed across devices and are fully standardized, even if the same character looks slightly different.
There's no such thing as a non-UTF8 character. You mean non-UTF8 bytes? If a system sees those, it should reject the entire input, not try to patch it up.
and there are many trash implementations that dont recognise something like :emoticon: as shortcut and turn it into emoji, no no you have to use emoji keyboard to type them
You would be amazed at how ancient and poorly maintained many web servers are on the modern internet. SQL injection still consistently make the top 3 web app vulnerabilities as of 2021. If that isn't being sanitized properly I don't expect emojis would be handled much better.
For that particular bug, yes, but there have been many other variations on that theme and not limited to Apple tech. I've seen it nuke an email send for example because the SMTP server choked on emojis placed in a subject, to, or from line.
Jeez, you're right. We got pens, pencils, stock charts, even those folders with the colored label tabs, but no stapler, the most basic of office equipment.
In my experience the only one that works with any degree of reliability is YouTube. Even the Netflix one can be fairly intermittent.
Also a lot in the time you'll go away and the hotel you're in will have a smart TV and the software was last updated in 2011 so you have to sign in on the device.
I've had to manually type in passwords on a TV several times in the last few months because sometimes the login for even the biggest brand-name services is just broken.
But it's actually possible to set a password with emojis anyways (or at least for domain accounts). I successfully logged in on a VM using the Hyper-V window and pasting the emoji from the host. You can also name an account a single emoji and windows actually handles it decently. It's very likely to break a lot of programs though.
No. There's only one piece of advice that should be given to users in 2023 about how to make their passwords stronger:
Use a password manager
Just use 32 character random alphanumeric passwords that are unique for each site (you can do more like 12-16 characters if you'll ever need to enter manually).
This is it. Stop trying to create clever passwords that you can remember. You aren't as uniquely creative as you think and there's been bodies of research into how the various things people do to create passwords that look secure can reduce the generation space so much that they become considerably easier to crack with an intelligent algorithm.
typing f or d for consonants and vowels respectively in sentences I thought up, switching languages regularly,
and a stable 56% by just typing randomly and adjusting my patterns based on the colored output, which might have skewed my results.
Certainly a very cool tool, I also liked the explanation linked on the page!
I like doing entire phrases with some rhymes thrown in. Makes it easier to remember them.
"BonyTonyMoansHe'sOnlyGrownLonely" has a shitload of characters, and a full sentence (even a nonsensical one like that) is more memorable to me than a random handful of disparate words.
The more ridiculous, the better. (And, naturally, don't forget your numbers and symbols)
EDIT: Actually, no idea why I made it all one group of words. So long as spaces are in the password's character space (and they very well should be if friggin' emojis are), there's nothing stopping you from doing an entire, punctuated sentence- other than that we've been conditioned not to think of a password that way.
"Skinny Kenny's friend, Mini Ben, has 20 chins." That should be a fully-acceptable password with 46 characters (48 if you add the quotes), capital letters, numbers, and special characters.
You can't compare a 46 random character password to a password composed out of words, the entropy of each is very different. Your kind of password is vulnerable to dictionary attacks which are way more common and easy than brute forcing every possibility. A 50+ characters unique random password for each service that is stored in a password manager which is encrypted with a 20+ characters random password is the most secure and future proof (for now).
Edit: plus brute forcing is just one scenario. I think the xkcd comic refers to using passwords in online services, and those usually have some sort of rate limiting.
I prefer picking a sentence or so that has meaning to me, using the first letters, and then adjusting for numbers/symbols. So if I wanted to make that a pw, it'd be 1ppa505thm2m,utfl,atafn/5. -looks completely unintelligible, but as long as you can remember the sentence and have some ideas of how you would have encoded it, easy enough to remember/recreate.
The whole idea is to make it easier for humans to remember and more difficult to brute force. Long passwords are much harder to brute force than complex passwords with lots of special characters. And they're a lot easier for humans to remember.
There are enough words in any language that it's virtually impossible to guess the correct four words, even if they're in the dictionary.
Edit: Oh. Did a "Wooosh" happen to me right now? Are you being ironic and referring to the XKCD thing about how to make a secure password using words in phrases?
Two of my colleagues still use locally stored plaintext for individual work credentials, despite having been shown where the password manager is. Both have accessed their files in front of me. If it's not in those files it's saved in the browser (because convenience is a hell of a drug). Now you start to see why discrete managers have a hard time, even amongst technology workers.
Sounds great where it works but I'm sure most systems would reject an emoji or make you type out some overly complex password in addition to your emoji.
Honestly you'd be surprised how many places it just works magically. I was surprised to find that Office365 users could use emojis in names for Microsoft Teams which had no problem syncing those accounts back to an on-prem Active Directory. You can use emojis to name a whole SQL database, let alone users/passwords on it.
I keep wondering if I need to figure out how to turn that off but it hasn't caused any problems. It's definitely sketchy looking though when you see a bunch of normal usernames and then suddenly one is just ten snowman emojis in a row.
Emojis are just a string of special characters that get recognised and replaced by an image anyway. It is the same as using those special characters separately.
It's all just Unicode so in theory a password system shouldn't think that emoji or any more interesting than any other character. To a computer the letter B and the emoji ✈️ equivalent in that they're both just normal characters that one can type.
Sort of, emoji are usually treated as two or more normal characters so ✈️ might be equivalent to BB. But the basic point is the same.
It should work reasonably well in password systems that hash the password from a UTF-8 encoding... Which should be most things really. If the system is trying to process everything with ASCII, maybe not. It might even appear to work but get converted to some other character (which is kind of the worst case)... That should be rare in web applications though
People who use them tend to spam the hell out of them. Like, 8 of the same emoji. And they use them every other sentence. It's obnoxious, you only need one or two to get the point across.
😠 I hate it when people do that because the emoji don't mean anything. Like I can use a single emoji to actually relay some information but just putting a bunch of them doesn't do anything.
I'm convinced emojis are what has been missing from language for a long time. They are great way to portray emotions through texts, which otherwise could not be achieved.
They didn't exist yet when I was an early teenager, all we had were emoticons that might be replaced by images by the forum software, so of course I think they're stupid /s
Without sarcasm, it is a good thing we have standardized symbols now and don't have to implement emoticon replacement into forum or chat or social media software. If only because half of such implementations replaced any occurrence of the number 8 followed by a closing parenthesis with 😎 even when that wasn't the intended meaning (one can think of many other times one would end a parenthetical statement with the number 8).
As a software developer who has worked with a lot of symbols and emoji... PLEASE DON'T DO THIS.
Software doesn't all handle these symbols the same way, and without tech knowledge (or even with) , it's very possible to not be able to log in easily. I'm kinda drunk rn, but I'll try to explain as simply as I can...
For example... skintone emojis are actually two characters, a face and a skin tone modifier. I think those ones are always two characters but some of these "multi-char" characters can be normalized into a single character. But not everyone handles this the same way. For example, Safari might normalize the emoji, but Firefox might treat it as two separate characters... And this would probably make your password not match. But basically... text has lots of edge cases; I'd advise to use normal passwords please (also maybe a password manager)
Thanks for the feedback! I'll be sure to use non-printing characters instead of emojis for my passwords! (They can't guess it if it's invisible right?)
In all seriousness, why are people so adverse to using password managers? People are plenty willing to use the browsers built-in "remind my password" instead of a proper password solution such as bitwarden... And they come up with such "hacks" just to avoid using a proper length password.
Emojis do not look the same on all platforms. Let's take white large square ⬜ for example. Emojipedia shows what that emoji looks like on 26 different vendors. Some are pure white, some are shades are grey, and then there's Microsoft who in its usual infinite wisdom decided it should be purple. large yellow square 🟨 is a tossup between actually yellow and orange. This issue is also exacerbated with different displays displaying colours differently. Factors such as color accuracy, viewing angle, brightness affect how you perceive colour.
This also extends to face emojis. grinning face with big eyes (Emojipedia link) isn't that easy to tell apart from grinning eyes (Emojipedia link)
Emoji support depends on your device. I'm on Windows 11 22H2 which recently added support for shaking face 🫨. Problem is, Windows' emoji picker Win + . (period) doesn't have it. Trying to login on a friends phone that's still on iOS 15 or Android 12, before shaking face came out? Enjoy manually copy/pasting the emoji from Emojipedia.
It depends on how the password is stored / KDF used (what type of hash, salting, bcrypt, etc).
Judge for yourself if it's an old website or old piece of software that might use (god forbid) MD5. Since one would not normally know that, I'd go with 20 (good, cryptographically) randomly generated upper/lower/digits if using a password manager, or 40ish characters passphrase if you need to remember and/or easily type it. Add some punctuation / special chars (spaces, commas, dots, paranthesis, etc) if it's an important masterkey (ie password manager key, encrypted container, etc) and you have decent typing skills.
Some shitty sites / routers don't accept certain special characters hence go with upper/lower/digits as standard but use longer lengths (if the shitty site allows you and doesn't limit that too). Limits to what a password should contain and/or length limits would be a sign of lazy programming and poor password management, so treat them as unsecure from the get-go (yes, even big names like Oracle have piss-poor security or lazy implementation). Good programming nowdays shouldn't have those limits, as user input sanitization / injection protection exists, and hash functions have a fixed length no matter what the input length is.
Also very important, don't reuse passwords for online accounts. Hence a password manager remembering them for you. There are still websites storing passwords in plain text. You wouldn't want your local pizza hut know or leak your email password by being hacked.
Seriously tho: go for at least 80 bit randomized characters. If it's something you have to type, use a couple of random words. Longer passwords are exponentially more secure.
Last week or two I've been learning more about passkeys, and it makes threads like this seem ridiculously out of date.
Given the choice between emojis and passwords and hard crypto, I'll take the crypto.
With passkeys, your browser and the website exchange a public-private key pair then make up long random one-time "passwords" every time you login but only use them to check they each still have the right key.
Long time ago a friend of mine used a set of key press to generate a smiley face to put in his bios which ended up in a situation where he was not able to type in the same smiley face into the password prompt. I had to teach him to reset his bios battery to get back into the bios.
this feeeels like the stupidest idea ive ever heard.. its not like theres really an emojii standard applied as universally as text, across devices or applications... the transforms that happen... this seems fraught with terribleness
Emojis are standardized exactly the same way as text is, both are defined by the unicode standard. They might not be rendered uniformly, the same way that text rendering depends on the font.
I thought Emojis were a set standard but how they're rendered can change. So whatever it is that identifies the heart emoji is universal but iPhone, Samsung, Google, etc might render that heart differently.
How they're rendered is a set standard now too. For example there was a bit of an issue where the gun emoji could be a water pistol pointing left or a revolver pointing right... and when it was combined with a person emoji... that could lead to... issues. It's a water pistol everywhere now.
Although I agree it is risky, emoji are unicode characters, just like any other unicode character. If, and that's a big if, the programmers do their job right, it shouldn't matter if you use an emoji or a random kanji. It's all just another character. That said, I don't trust programmers enough to run the risk. Your password might work fine on the website but then fail on the mobile app.
Someone else said "good luck on the desktop", but Windows actually has an emoji picker built right in. Win+. will bring it up. Another fun fact, usernames and computer names both support the full unicode set on Windows, including emoji. Some fun can be had with that knowledge. I haven't tried it on Linux or MacOS yet.
Yes there is, . I would say most modern devices/systems utilize it too. The reason they may look different from device to device is because the presentation style can be modified by vendors, somewhat similar to using different fonts to make letters look styled.
It will look like it's random - for example "I like my lemmy only with beans and bacon" becomes "ilmlowbab" - and it comes from a far vaster possibility space (ever possible sentence and it need not even make sense) than that of "words in the English language and derived words" so it's a lot harder to try to crack with a dictionary attack.
Also it works in everything that takes ASCII charactes (i.e. everything but numeric only pin codes).
Okay now's my time to shine. The words "emoji" and "emoticon" are false cognates, as in they aren't actually related. Emoticon is a few-decade old word to describe emotion+icon, like :)
Emoji is Japanese (kanji - 絵文字) for picture-word, basically. It super outdates computers.
They just happen to sound similar; isn't that fun?
For petty services where you don't want to have to break out the password manager, try making your own mental salted hash.
Pick four long words at random. Assign each of these to the four quadrants of the alphabet.
A-F - Equipment
G-M - Triumphant
N-S - Sampling
U-Z - Fatigued
Pick one number:
4
Now, take the first letter of the service that the password is for, and that selects your quadrant word. Take the number of letters in the service and multiply it against your number. Take the last letter of the service, and on your querty keyboard, move all the way to the right of thst line to select the first symbol there. Thats your unique password thats salted with yo ur personal words and number.
Facebook = Equipment32:
Lemmy = Triumphant20{
Pizza Hut = Sampling36{
If you want more security for these petty services, use longer words, bigger number, or use some other metric, Tweak the algorithm to make it unique to you. Maybe capitalize a middle letter in your salt word based on the length of the service name. Maybe add the first letter of the colour of the service logo to the password, EG
Facebook = Equipment32:B
Lemmy = Triumphant20{T
Pizza Hut = Sampling36{R
Petty services I would consider to be anything that's not super critical, and is at a higher likelyhood of breaching my shit.
For banks, primary emails, or government services, use a more complex algorithm or a random string of chars from your password manager.
Just come up with one strong password (see https://xkcd.com/936/) for your password manager and use randomly generated passwords for everything else. There's no reason to manually compute a hash every time you sign up for a service.
Also, for a non-remembering solution, use a security key with your password manager, the kind that plugs into USB and you have to tap a button to authenticate. Then you can generate a true random password and store it somewhere safe as a backup, and mainly use the key for day to day.
Youre going to memorize a unique sentence for each service?
A method like this allows you to memorize only 4 words of arbitrary length, a number, and a simple algorthm to yield unique passwords for each service.
Yeah putting the name of the service in the passphrase is actually pretty secure, unless the rest of the password is like "thisisapasswordforFACEBOOK" cause then one password gets leaked and the rest can be inferred.
This is what got me using a password manager. I didn't want to trust a password manager because it felt like they would be highly targeted and one vulnerability would reveal everything. And let's be honest they still are the same.
So I had my own scheme for generating passwords. I made myself a script that I could use on my phone and PC. It worked beautifully and effortlessly until occasionally a service would force me to choose a new password. When this started happening I made a new scheme for generating passwords and made a new script. When it first happened it was still reasonably easy because there was only one service I had to use the alternative. It started to become more difficult the more services asked for a new password.
I used my own system for several years until I had enough with trying to remember which services used the alternative scheme and wondered when I'd have to make a third scheme. And if I did then the mental complexity would significantly increase.
Interestingly only a couple of services publicly announced they had been hacked and none of my passwords have ever appeared on haveibeenpwned. So I wonder why these services asked for a new password and if they had been attacked why they chose not to announce it.
Havent read the article yet but If you have to manually input just stick to 6 or more randomly generated words (different languages if you would like to). A keyboard won't always have options for emojis. Your password manager's autofill/autotype everywhere else and 2fa where you can thats it dont overcomplicate things thats a good way to screw yourself over
Come on seriously? There are guys out there who send pictures of their genitals to women thinking that'll impress them. I'm sure you've heard at least one idea worse than this. 😜
(psst don't tell anyone but that emoji is in my lemmy.world password... maybe)