NULL license plate not such a bright idea • Hacker News Board

Re: NULL license plate not such a bright idea

#291

Post by tracker1 » Mon, Aug 12, 2019, 8:40 PM UTC

indianSummer wrote: post #70

I own a rare collector car with a three-digit VIN. This has caused endless hassles at the DMV as well as the insurance office. Sometimes we find success by prepending the necessary number of zeros, before the VIN. Other instances in the same system require appending zeros after the VIN. The true VIN has a hyphen but that never makes it into the DMV's system. One time I got stuck in a particularly nasty loop where the…

I used to work for ClassicCars.com ... there's a LOT of variation to VINs before 1980, they standardized in the early-mid 70's, used to know the specific year.

Re: NULL license plate not such a bright idea

#292

Post by olyjohn » Mon, Aug 12, 2019, 8:48 PM UTC

ldoughty wrote: post #36

I have a family member who's license plate started with "&". The DMV accepts it, plates were ordered online fine, but police systems can't handle it apparently, to my family members ultimate discomfort. I commonly joke it probably gets the individual out of automated tickers for speeding and red lights, but when an officer pulls them over we sometimes need to explain that the "&" is dropped in the system (or so we've…

In Washington State, you can register period-correct plates for your car. The problem is that you can't register the actual digits that are printed on the plate. The cops and cameras can't pull up your information, and you get stopped and questioned all the time. Explaining how the plates work to the Police gets pretty tiring.

Re: NULL license plate not such a bright idea

#293

Post by logicallee » Mon, Aug 12, 2019, 8:49 PM UTC

Let's talk about one specific thing from the article:

>Things started to go awry when he first registered the tags. He tried typing in his license plate but the DMV website wouldn't accept it.

Let's talk about the fact that the DMV website wouldn't accept it. Do you think this is all right behavior on the part of the DMV website?

It's really interesting because if you're coding up the DMV web site, it makes sense to disallow NULL just as a preventative measure, like not allowing '-- in a query (to prevent SQL injection attacks.)

I would generally think that on the whole you should accept -- as a substring in a password. But is it wrong programming if you don't allow that substring?

Disallowing it could cause someone's chosen password to fail, so they have to change it for you to accept the password they want, but if you know for sure that you use sql as part of processing passwords you might well decide that it is acceptable to make people have to try a new password before you'll accept theirs, in case you are not confident that you are escaping everything correctly.

So from my end it seems okay to do something like disallow NULL.

If you consider the choice of the programmer on DMV's web site, what do you think about their choice to reject this input, even though in fact it turned out to be legitimate? Is it acceptable programming practice?

Re: NULL license plate not such a bright idea

#294

Post by yummypaint » Mon, Aug 12, 2019, 8:50 PM UTC

Sounds like it worked. He can now accrue tickets without penalty.

Re: NULL license plate not such a bright idea

#295

Post by ValleZ » Mon, Aug 12, 2019, 8:50 PM UTC

gruez wrote: post #184

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

>Avoid backticks in passwords. Is there even a reason to include special characters in passwords? They add 10% more security[1] but cause all sorts of issues with systems. Just use an alphanumeric password that's 10% longer, and if special characters are mandatory, use a safe character at the end like _ or -. [1] 6.55 bits per character (all printable ascii characters) rather than 5.95 (only alphanumeric)

Is there a special reason to forbid using native languages unless your native language is English?

Re: NULL license plate not such a bright idea

#296

Post by recursive » Mon, Aug 12, 2019, 8:58 PM UTC

gruez wrote: post #184

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

>Avoid backticks in passwords. Is there even a reason to include special characters in passwords? They add 10% more security[1] but cause all sorts of issues with systems. Just use an alphanumeric password that's 10% longer, and if special characters are mandatory, use a safe character at the end like _ or -. [1] 6.55 bits per character (all printable ascii characters) rather than 5.95 (only alphanumeric)

Another way to say this that wouldn't rile so many people up is "In order to achieve the same size search space, you'd have to use ~10% more alphanumeric characters than all of printable ASCII."

Re: NULL license plate not such a bright idea

#297

Post by heeen2 » Mon, Aug 12, 2019, 9:01 PM UTC

gruez wrote: post #238

mfoy_ wrote: post #230

Earlier quoted context omitted.

According to KeePass2, the password: "12" contains 7 bits of entropy, but "1234" only contains 5 bits of entropy. Is that right?

I wouldn't trust it. If you use the "Hex key - 128-bit" preset, it returns a different amount of bits every time you click it. Here are 3 samples: 3f38ba8a6ce3aa800f007c2e431df7fd 124 bits 9339bf587ee11b12d207df846a879cf4 129 bits 8ca4354a9038df590fecec1f964062fd 121 bits

Due to missing or repeated characters from the set of the hex alphabet?

Re: NULL license plate not such a bright idea

#298

Post by luc4sdreyer » Mon, Aug 12, 2019, 9:02 PM UTC

dajonker wrote: post #250

cgriswald wrote: post #236

Earlier quoted context omitted.

Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.

Yes, this is terribly annoying, often there is a minimum length but no mention of maximum length. I see this on many, many websites...

What kind of range limits are you talking about? 30? 100?

Re: NULL license plate not such a bright idea

#299

Post by MaxBarraclough » Mon, Aug 12, 2019, 9:03 PM UTC

EliRivers wrote: post #9

Related, for those who missed it the last time it was here on HN, the tales of Christopher Null, who has an unfortunate surname: https://www.wired.com/2015/11/null/ , and Jennifer Null , http://www.bbc.com/future/story/20160325-the-names-that-brea... , likewise.

Much-needed Outline.com of the wired.com article: https://outline.com/WMzjYK

Re: NULL license plate not such a bright idea

#300

Post by crumpets » Mon, Aug 12, 2019, 9:05 PM UTC

jerf wrote: post #113

slips wrote: post #109

Earlier quoted context omitted.

Did you read the article? It literally says people at a private citation outfit put NULL in the license plate field when there is no number available.

And I still expect my story is more accurate, with theirs being a reasonable expectation of what you'd get when some techie tells their manager what happened, who tells their manager, who tells the reporter. To be clear, I'm not denying that what you say is literally true, just that by the time I'm done filtering that particular fact through my personal belief network and personal experiences, I still end up saying t…

People use the word NULL and in all caps as well, in particular in bureaucratic processes like those you would encounter at the DMV.

NULL & VOID, etc.

It is entirely reasonable that the system would not accept an empty string for the plate so the process folks worked around that by instructing all employees to write NULL if they couldn't read the plate.