But you can also save up what you’d spend on housing, then rent from savings.

It’s at least a bit nice of them to plan working a bit more.

Cloudflare seems to have .wtf at $28.20/year (they sell at cost).

I plan to perhaps, just maybe, I am not sure, to try self-hosting an email server. But I’ll need a good uptime.
Although I am really scared about security.

Ooooo, that looks nice.

conditioner because long hair, shower gel for the body

Uuuuuh, hello.
I don’t know how to take care of long hair. I never used conditioner, just whatever says “shampoo” sorted by price from lowest (per amount, not bottle). I wish I could just get rid of it instead, but I have large psoriasis patch at the back of my head and neck, and the hair hides it. The only purpose, otherwise I’d rather go bald.
As for shower gel, I can’t manage to wash it off with hard water, so I use bar soap. I also used to use bar soap for scalp and hair, but I figured it made the psoriasis worse.

This password has been seen 37,384 times before in data breaches!

Holy shit, I didn’t expect people to really use it, even with a changed digit.
https://haveibeenpwned.com/Passwords

The salt adds nothing

It prevents cross-service re-use, should the original password hash be obtained (if other services used the same system).

Example (MD5 in b64 used for simplicity): Same password is used on website1 and website2. The password is password.
password produces KGdV+tBIacpSMyCszg3GpA== which can be used for both websites.
Now, if website1 adds sbo2 as salt, and website2 addsx3e5, you get:
passwordsbo2 -> d0bd511zpYqG3//3vLGYRQ==
passwordx3e5 -> 788BnQKx7B2KOSju2jviiQ==

So if you are on a corporate network that does MITM (you had to add their root cert) for monitoring, they’ll only see a hash for each website separately, without being able to re-use it.
Though that’s quite a bit of an edge case, and assumes no client modification or other monitoring.

Analyze password entropy client-side. https://dropbox.tech/security/zxcvbn-realistic-password-strength-estimation

If there would be an advantage to doing so, the server could still do that anyway. You’d just end up storing client salt and server salt.
My main concern was MITM which doesn’t modify the webpage if web UI is used, such as on corporate networks which require client devices to have that network’s root certificate for scanning and activity logging.

You already trust the client with your password regardless.

Same as usual, only if that person wants to.

There’s a large difference between painless euthanasia or instant suicide (e.g. shot in the head) and, say, burning to death or getting buried alive under rubble.

the broadly accepted ethic is that people are not allowed to kill themselves OR put themselves in dangerous situation because they want to die

Which is bullshit.
I was born without my permission. Obviously. That’s already bad enough.
I should at least be allowed to die from my own will. It’s not like there is any physically possible way to regret death, just like there is no regret of not being born.

Opus No.1 by Tim Carleton and Darrick Deel: https://archive.org/details/20250518_20250518_2255

Trying to reach my brain, but no one’s there to answer, I am still on hold.
https://en.wikipedia.org/wiki/Music_on_hold#Cisco’s_Opus_Number_One

First round of hashing could be done client-side, and then send that to the server.
Would be cool to also add salt so that the hash couldn’t get re-used across services even with the same source password/file if somehow captured.

Idea:

1. Enter username
2. Server sends salt to client
3. Enter password or key file
4. Client computes hash of the password or file with salt added (I have no idea how it’s used. If appended, some hashing functions could truncate the data, losing the salt. If prepended along with truncation, you just made the password even shorter. XOR?)
5. Client sends hash to server
6. Server hashes the hash same way as if it was password
7. If it matches, you’re in

Basically, the hash is your password. Data can be whatever.
Most websites already use JavaScript, so why not.

Because I was on a student contract, and got kicked out of college.

If it works, it works.
Considering that people often hookup just for sex, I don’t see why it couldn’t work in this case.

I ask AI to make me a random password for “x” service. Whenever I need to remember it, I just ask again

I’ve already seen someone do that, a certain family member. At first I found it funny when they asked an LLM about their WiFi password, which was some gibberish. But it worked. There’s no way something like that would be default across entire product line.
Indeed, when I asked, I got “I gave it screenshots of everything because I didn’t know what to type where”.

Oh, I like the pay-as-you-go pricing they have as well.

As well as

In Purelymail, Users represent unique email addresses, each with its own dedicated inbox and private login credentials. We operate on a resource-based model, meaning we don’t charge per user or ‘per seat’.

I could have a work related “user” and log only into that on a work computer, without exposing everything else. Neat.