Why not just allow users to use lowercase a for their password? This would have helped me register for the website.
However, the app does not enforce lowercase/uppercase. It uses Laravels uncompromised() function which I think makes sense. It checks against https://haveibeenpwned.com/Passwords.
I'm happy to discuss length! But I think the uncompromised makes sense. But happy to hear any arguments!
If it makes it harder to register, that is still an argument and must be discussed against the argument of security. I'd love to hear other peoples thoughts here since security vs usability is always a complicated thing.
Don't make your password requirements less strict. Don't encourage people to use weak passwords that are likely shared across sites. That leads to pain and suffering over the long term.
If you want to reduce friction for people who don't/won't use a password manager, provide a passwordless option like a login link that is e-mailed to them. Yes, people will likely complain about "your service is supposed to be my email, why are you requiring an e-mail to login", in which case they should be using a strong password.
To the person requesting weak passwords: Just set up google or firefox password password manager, it will auto suggest a strong password on the registration page and save it for use across devices. There is zero reason to be using the same password across accounts, and a lot of reason not to.
Attackers do actively try passwords you have used on other sites to try to compromise your accounts elsewhere. This happens when services leak passwords or password hashes. If your password is short and lowercase, it really doesn't matter if only your password hash has been leaked, it might as well have just been the password itself. This is the lowest-hanging fruit for attackers.
People should be using a password manager, then they can set that to 100/200 characters. Even if all lower case, it will be unbreakable (assuming a modern/secure one way hashing algorithm, and the password manager is truly random.).
If they are not using a password manager and use something like `waterfall!X` (because you enforce a special character and capital letter) you haven't actually increased entropy by that much, compared to a longer password. Them making up a 100 character password will almost guarantee more entropy than a short password they make up like `waterfall!X`
Also, because it's the internet [1]:
I've been frustrated for a while with what's out there. I'm a data hoarder and love to organize things, but I kept jumping from app to app - started with Notion, but was frustrated with speed and then privacy issues. Switched to Obsidian, tried to do everything there, but figured Obsidian is great at notes, but wasn’t meant for writing custom JavaScript code to build libraries. Tried AnyType, found it confusing. Tried lots of other apps and was annoyed by pricy subscriptions, useless AI features and lots of “you should do this” things. There are great open-source options for most everything, but being a software developer at work, I really didn’t feel like stitching together 6 apps to do what I want and also, I found that’s not accessible to everybody.
I just wanted an app that does what I need in my daily life, that is easy-to-use and no-bullshit. So I built solyto. It’s completely free, open-source, self-hostable and community-focused. I’ve been using it with a couple of my friends for half a year and have replaced pretty much every other app I’ve been using. I’d love for this to be useful to others as well and to be some kind of community project - people suggest or wish for things, I (or other contributors) build it and that’s that. No company shit, no money incentives, no other motives.
Solyto is available at https://solyto.app.
It does todos, notes, calendars & contacts (with DAV sync to your phone), music library, book library, games library, news, daily trackers, finance tracking, time tracking, well basically almost everything I could think of. And if a thing you’d like is missing, I’d love to build it!
If any of you would like to try it out, you can do so via the website or via GitHub for selfhosting. We have pre-built images, compose files, etc. If anything is missing, let me know!
Anyway, I'd love feedback on this. Any kind of feedback! And of course any questions are also welcome.
Cheers, Leo
Links: - App: https://solyto.app - GitHub: https://github.com/solyto/solyto - Self-hosting instructions: https://github.com/solyto/selfhosted - Discord: https://discord.gg/JbNPJHG6
Also I wonder... How sustainable is this? Free is great, but what is your income/maintenance model? E.g. you offer calendar which even many paid email providers don't offer.. :-)
Thanks for what looks at the surface like a very sleek tool.. i haven't been able to see it on substance.
It appears Laravels throttling function doesn't work well with my reverse proxy setup. I have disabled it for now. I have just tried it out and registering works again.
Again, sorry for this. This is my first publication attempt and I fear some issue will only show this way.. however, I'm here and happy to fix everything on the fly :)
I did think a lot about monetizing it, but really I feel like that would skew the whole idea of the app. I want this to be for the community. We struggle enough with enshittification anywhere. I'm in a privileged position where I can build and maintain this. And it's available for self-hosting, so anybody can do so as well.
Now, if we were to hit an insane amount of users, the question might have to be tackled again, but that's far away and I think with the infrastructure I have and can get with my allocated "solidary" budget, It'd really have to get to insane amounts to actually be an issue.
So I'd like to think it is indeed sustainable. I'm doing this to be sustainable. I want to build something people appreciate and use. I'm happy to spend lots on it!
Small suggestions:
* maybe default-disable some of the modules people are less likely to use (e.g. finance). After doing the selection the onboarding-per-module tries to go through everything - maybe easier to start with 3-5 default and then invite people to add? It feels a bit overwhelming if you don't really know what you want yet. But that might all just be me. * I noticed DE and ES are "du" but FR is "sie", not sure that was intended, I guess it's AI misinterpretating the prompt (or maybe the eternal DE-FR feud made the "vous" a conscious choice?). The German is also a little clunky but that's quite normal for translations.. * Some info on how to export would be great (e.g. MD notes) * Maybe you want to make a slight narrative change, from "sign up for free" (which I read first as indicating that a payment requests comes later) to "sign up - it's free" and summarise a bit your philosophy as above to make clear that you intend to keep it that way - but maybe it's already there and I missed it :-)
Tolle Initiative und immer schön zu sehen wenn Leute versuchen die Welt besser zu machen!
- You are totally right. The "Try it for free" could very easily hint at cost down the line. I have changed it :) - Cool that you understand so many languages :) And thanks for your suggestions. Looking into it right now. Translations is one of those things.. doing it by hand (not me, but someone with good language knowledge) is very time-intensive, but yea, AI can be hit or miss for it. - I'm definitely thinking about starting with a leaner set of features. My only fear would be that people forget there is more to it. But that should be solvable via UI. - Definitely going to add more info on export! That's a shortcoming right now which I aim to fix this week. - Regarding philosophy, I'll think about it. I'm not great at marketing (and don't even want to look at it as "marketing"), so I'm always a little unsure what messages belong where. But good to hear, that a more detailed part on this could be good.
Another thought I have discussed a lot is, this app is not something critical. It's not online banking, it saves very little about you (as little as possible), etc. - so what does this say about the compromise? If an account was to be compromised, an attacker would only have access to the todos, music, notes of a user. Now, todos and notes could be very telling, but I'm unsure about how much of a responsiblity I have as an admin to save users from this? Do you know what I mean?
I’d personally have a 12 length password enforcement, a password strength meter and nothing else. Possibly less if you introduce 2fa.