Asklemmy

I just got approved here, but have been on Mastodon for a couple of months. Mastodon signup was a lot glitzier, and yet I still couldn't convert my friend, who was like "I don't understand, what do you mean it's like email? >_<". I don't have high hope for Lemmy atm...

I think Reddit will backpedal and renegotiate with users/devs down the line, once the initial backlash has died down, and they have lowered everyone's threshold of what they would consider a "victory". Things like Lemmy will act as a sword of Damocles/safe harbour for the next time they screw up, sure, and that's a good thing. But I doubt Lemmy will explode in popularity, even if some 3rd party Reddit clients are discussing adding Lemmy support to sort of rugpull Reddit, and that's for 3 reasons(imo):

1. The hosting costs will be exorbitant for all those new users, considering
2. Lemmy will be stuck in the exact same boat as Reddit re:all those unpaying users, except now there's no ads either. Donations are the honourable business model, but a couple thousand well-meaning people with disposable income can't properly finance a popular platform.
3. Even if the Lemmy community solves the above 2 problems, you still have the deciding moment of the "let's jump ship today" user tidal wave, which will make or break such a migration happening. Closest thing I can think of is the WhatsApp Privacy Policy shenanigans in '21. Melon Husk said "Use Signal" - a fine suggestion, tbh - but Signal wasn't ready for this, and so their servers crashed and burned during the tidal wave, while for-profit Telegram just paid for more servers and thus converted the refugees into users.

Requiring a 10 character password with additional character conditions is going to turn a lot of possible new users OFF. It should be 6 characters, with no conditions.

I gather that is not your case and I see what you mean if I think about my parents for instance, but objectively I can only think that a 6 characters password with no restrictions (e.g. 123456) might have been "okeish" and yet still object of jokes 20 years ago, but now it shouldn't absolutely be passed as a norm anyway close to "adeguate", users need to be correctly educated on their own security awareness in general, but also especially here because the it is very likely that the instance where the user account is registered to will not have any paid customer service around to solve their users issues with account security breaches because of their weak passwords.

So regarding passwords for the casual as for the expert user once and for all the xkcd comics stripe on passwords:
https://xkcd.com/936/

and here is a couple of handy online and downloadable generators inspired from that comics stripe:
https://xkpasswd.ethanify.me/
https://xkpasswd.net/s/

But also learn to use password managers! Which also come often with their own handy password generators btw. The gist of it is that you need to remember only one password for the manger, and in turn it is going to remember and service for you your credentials for all your accounts. .

For instance for the average casual user Bitwarden should more than suffice, it is free, has a freely managed remote service, apps for mobile and extensions for the browsers, it is open source and has been audited: https://bitwarden.com/

I perfectly know that is a an uphill process, I can see that with my parents, but I also like to think that maybe if something I tell them about how to manage their passwords is able to stick in their mind then one day it might save them from being robbed online for always using the same few charters password everywhere for every effing website.