Stop restricting my password - Help these sites get better security.
weakpasswords.org
Stop restricting my password - Help these sites get better security.
1–10 of 61 posts
Re: Stop restricting my password - Help these sites get better security.
#2There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter.
It's really just laziness and incomptence on the part of the programmers.
Re: Stop restricting my password - Help these sites get better security.
#3I believe that the logic behind ING direct is that by requiring you to use a mouse to click out your password it prevents key sniffers. And they show you a keypad being a bank.
Re: Stop restricting my password - Help these sites get better security.
#4How timely! Just last night I was frustrated by a stupid policy when changing my online banking password (my bank is now listed). I think his once-a-month policy could stand to be more aggressive, though.
Re: Stop restricting my password - Help these sites get better security.
#5Erm, Delta sure seems like an odd member of the list, doesn't it?
They require you to enter a SkyMiles number and a PIN, along with your last name... all of which is certainly not very secure information. But ultimately, all that gives you access to is viewing a person's SkyMiles account. It hardly seems to make sense alongside banking sites.
Re: Stop restricting my password - Help these sites get better security.
#6 Google, MSN, Facebook, Twitter - They all already allow
you to use anything you want for your password.
Re: Stop restricting my password - Help these sites get better security.
#7American Express is the worst offender. They don't accept my usually long passwords/passphrases so I had to conjure up a shorter password just for their system.
Re: Stop restricting my password - Help these sites get better security.
#8ING's isn't a password it's a PIN number. That's why you can't use any letters or special characters.
Re: Stop restricting my password - Help these sites get better security.
#9There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.
> There's really no point in restricting length or non-alphanumeric characters.
I agree, the only rationale I can think of for this is that these institutions don't want people to forget their passwords, but even then I don't understand why they would want that at the expense of security.
Re: Stop restricting my password - Help these sites get better security.
#10Google, MSN, Facebook, Twitter - They all already allow you to use anything you want for your password. This is not strictly true - while Google et al might have a large set of permitted characters, there are nearly always restrictions on length. Google, for example, requires that their passwords be at least 8 characters long. While a long password does reduce brute-force attacks and shoulder-surfing, it nevertheless…
Requiring long passwords is a restriction that leads to a more secure password. This site (it's called weakpasswords) is about restrictions that make your password less secure.
The site for my credit card requires a password that is no more than 6 characters -- talk about insecure.