Looks a lot like desktop usage.
I have created https://github.com/qrauth-io/qrauth open source.
I can help with integration for Passwordless login if you want. Also bonus social login by default
Fair! I did think about this a lot. Initially, I also thought "8 characters of any kind" are fair enough. Then read a lot and decided a bit more security would be good. But honestly, given what you wrote, I did find myself happy that I had an account before this security measurement. So I guess, I'm of your opinion.
However, the app does not enforce lowercase/uppercase. It uses Laravels uncompromised() function which I think makes sense. It checks against https://haveibeenpwned.com/Passwords.
I'm happy to discuss length! But I think the uncompromised makes sense. But happy to hear any arguments!
If it makes it harder to register, that is still an argument and must be discussed against the argument of security. I'd love to hear other peoples thoughts here since security vs usability is always a complicated thing.
Don't make your password requirements less strict. Don't encourage people to use weak passwords that are likely shared across sites. That leads to pain and suffering over the long term.
If you want to reduce friction for people who don't/won't use a password manager, provide a passwordless option like a login link that is e-mailed to them. Yes, people will likely complain about "your service is supposed to be my email, why are you requiring an e-mail to login", in which case they should be using a strong password.
To the person requesting weak passwords: Just set up google or firefox password password manager, it will auto suggest a strong password on the registration page and save it for use across devices. There is zero reason to be using the same password across accounts, and a lot of reason not to.
Attackers do actively try passwords you have used on other sites to try to compromise your accounts elsewhere. This happens when services leak passwords or password hashes. If your password is short and lowercase, it really doesn't matter if only your password hash has been leaked, it might as well have just been the password itself. This is the lowest-hanging fruit for attackers.
There really are only two dials you can turn to increase the security of a password, and that's length of the character set (the characters that the user can use in their password) and length of the password itself.
People should be using a password manager, then they can set that to 100/200 characters. Even if all lower case, it will be unbreakable (assuming a modern/secure one way hashing algorithm, and the password manager is truly random.).
If they are not using a password manager and use something like waterfall!X (because you enforce a special character and capital letter) you haven't actually increased entropy by that much, compared to a longer password. Them making up a 100 character password will almost guarantee more entropy than a short password they make up like waterfall!X
I’ve been building something over the last year, with probably 1000 hours going into it. A personal management app that does almost everything while being privacy-focused, no-bullshit, open-source and selfhostable. It’s called solyto.
I've been frustrated for a while with what's out there. I'm a data hoarder and love to organize things, but I kept jumping from app to app - started with Notion, but was frustrated with speed and then privacy issues. Switched to Obsidian, tried to do everything there, but figured Obsidian is great at notes, but wasn’t meant for writing custom JavaScript code to build libraries. Tried AnyType, found it confusing. Tried lots of other apps and was annoyed by pricy subscriptions, useless AI features and lots of “you should do this” things. There are great open-source options for most everything, but being a software developer at work, I really didn’t feel like stitching together 6 apps to do what I want and also, I found that’s not accessible to everybody.
I just wanted an app that does what I need in my daily life, that is easy-to-use and no-bullshit. So I built solyto. It’s completely free, open-source, self-hostable and community-focused. I’ve been using it with a couple of my friends for half a year and have replaced pretty much every other app I’ve been using. I’d love for this to be useful to others as well and to be some kind of community project - people suggest or wish for things, I (or other contributors) build it and that’s that. No company shit, no money incentives, no other motives.
It does todos, notes, calendars & contacts (with DAV sync to your phone), music library, book library, games library, news, daily trackers, finance tracking, time tracking, well basically almost everything I could think of. And if a thing you’d like is missing, I’d love to build it!
If any of you would like to try it out, you can do so via the website or via GitHub for selfhosting. We have pre-built images, compose files, etc. If anything is missing, let me know!
Anyway, I'd love feedback on this. Any kind of feedback! And of course any questions are also welcome.
18 comments
Why not just allow users to use lowercase a for their password? This would have helped me register for the website.
However, the app does not enforce lowercase/uppercase. It uses Laravels uncompromised() function which I think makes sense. It checks against https://haveibeenpwned.com/Passwords.
I'm happy to discuss length! But I think the uncompromised makes sense. But happy to hear any arguments!
If it makes it harder to register, that is still an argument and must be discussed against the argument of security. I'd love to hear other peoples thoughts here since security vs usability is always a complicated thing.
Don't make your password requirements less strict. Don't encourage people to use weak passwords that are likely shared across sites. That leads to pain and suffering over the long term.
If you want to reduce friction for people who don't/won't use a password manager, provide a passwordless option like a login link that is e-mailed to them. Yes, people will likely complain about "your service is supposed to be my email, why are you requiring an e-mail to login", in which case they should be using a strong password.
To the person requesting weak passwords: Just set up google or firefox password password manager, it will auto suggest a strong password on the registration page and save it for use across devices. There is zero reason to be using the same password across accounts, and a lot of reason not to.
Attackers do actively try passwords you have used on other sites to try to compromise your accounts elsewhere. This happens when services leak passwords or password hashes. If your password is short and lowercase, it really doesn't matter if only your password hash has been leaked, it might as well have just been the password itself. This is the lowest-hanging fruit for attackers.
People should be using a password manager, then they can set that to 100/200 characters. Even if all lower case, it will be unbreakable (assuming a modern/secure one way hashing algorithm, and the password manager is truly random.).
If they are not using a password manager and use something like
waterfall!X(because you enforce a special character and capital letter) you haven't actually increased entropy by that much, compared to a longer password. Them making up a 100 character password will almost guarantee more entropy than a short password they make up likewaterfall!XAlso, because it's the internet [1]:
1. https://xkcd.com/936/
I've been frustrated for a while with what's out there. I'm a data hoarder and love to organize things, but I kept jumping from app to app - started with Notion, but was frustrated with speed and then privacy issues. Switched to Obsidian, tried to do everything there, but figured Obsidian is great at notes, but wasn’t meant for writing custom JavaScript code to build libraries. Tried AnyType, found it confusing. Tried lots of other apps and was annoyed by pricy subscriptions, useless AI features and lots of “you should do this” things. There are great open-source options for most everything, but being a software developer at work, I really didn’t feel like stitching together 6 apps to do what I want and also, I found that’s not accessible to everybody.
I just wanted an app that does what I need in my daily life, that is easy-to-use and no-bullshit. So I built solyto. It’s completely free, open-source, self-hostable and community-focused. I’ve been using it with a couple of my friends for half a year and have replaced pretty much every other app I’ve been using. I’d love for this to be useful to others as well and to be some kind of community project - people suggest or wish for things, I (or other contributors) build it and that’s that. No company shit, no money incentives, no other motives.
Solyto is available at https://solyto.app.
It does todos, notes, calendars & contacts (with DAV sync to your phone), music library, book library, games library, news, daily trackers, finance tracking, time tracking, well basically almost everything I could think of. And if a thing you’d like is missing, I’d love to build it!
If any of you would like to try it out, you can do so via the website or via GitHub for selfhosting. We have pre-built images, compose files, etc. If anything is missing, let me know!
Anyway, I'd love feedback on this. Any kind of feedback! And of course any questions are also welcome.
Cheers, Leo
Links: - App: https://solyto.app - GitHub: https://github.com/solyto/solyto - Self-hosting instructions: https://github.com/solyto/selfhosted - Discord: https://discord.gg/JbNPJHG6