Or maybe introduce them to Little Bobby Tables

Permanently Deleted

From many years of experience on the interwebs, I can recommend this password:

NUL,\t.;TAB\n\x07^C

It's very secure and works most of the time. I use it for everything.

While you're adding commas, learn how apostrophes work.

My main problem with passwords is the limits that sites put on what I can set for a password.

I could not tell you how many times I reset my password using my password manager, then immediately log out, and log in using the credentials I just saved into my password manager, and they don't work, because the site is truncating the password to 15/20/whatever characters.

The number of times this limitation is not clearly stated, checked for, or even acknowledged by the site is too damn high.

I've made it a habit of testing a login after every password set/reset to ensure I don't have trouble with it in the future.

Funny, but csv values are quote encapsulated and special character escaped.

The CSV cells are escaped with quotes. So just maybe throw some quotes in too. Unbalanced for style points. It won't defeat a CSV library, but might break a script kiddie

If you include ;",// you can mess with a wide variety of formatting.

'; DROP TABLE `passwords`; --

"comma's"?

"COMMA'S"?!

Use a password like MARCH1 so that Excel will change it when the data is loaded.

The CSV specification (RFC-4180) is pretty clear. If a value contains commas, you wrap it in double quotes. If the value contains double quotes, you double each double quote to indicate its part of the value and not the end of the value.

A properly formatted CSV should have no problems from Skeletor!

While on the topic, this isn't how passwords work in systems.

Passwords are stored as one way hashes. So it's cryptoed only in one direction, it's lossy, and can't be recovered back to the original password.

When you log on, your cleartext PW is hashed in ephemeral memory/storage and then the cleartext password is thrown away.

That hash is compared to the hash in the DB. If the hash matches, then you have access. If it doesn't, then your PW is incorrect.

Security advice: Just use URLs/links as password. Until next time!

Remove apostrophes from your plural words, they show possession, not plurality. Until next time.

Can you add a "TAB" into a password?

If webpages are storing plain password and not the hash, we should be worried

Hi kind reminder password hashes.

Add commas* to your passwords

So

;,'"\tpassword\t,.;

What about semicolon?