NULL license plate not such a bright idea • Hacker News Board

Re: NULL license plate not such a bright idea

#481

Post by Breza » Fri, Aug 16, 2019, 1:10 PM UTC

cgriswald wrote: post #236

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.

I learned this the hard way when I started using a password manager. I had the bright idea to start using 90 character passwords for all my accounts and suddenly I couldn't log into a lot of accounts.

Re: NULL license plate not such a bright idea

#482

Post by Breza » Fri, Aug 16, 2019, 1:13 PM UTC

inopinatus wrote: post #421

cgriswald wrote: post #236

Earlier quoted context omitted.

Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.

Square Enix's account management on the PS4 allowed me to set a password with a space on the end, but their website strips spaces from the password field when you sign in. Fun fact: it's actually really easy to submit a string with a space on the end when entered via a PS4 controller.

Back in the day, I created an AOL password with CTRL-BACKSPACE in it. It worked when using the AOL software but when I tried to log into the website, it deleted the password.

Re: NULL license plate not such a bright idea

#483

Post by dulvac » Fri, Aug 16, 2019, 1:56 PM UTC

I have a friend who told me his story enrolling in his university. He's a German national who grew up in Spain. I'm going to call him Andres Schmidt, as the actual name is not relevant.

In Spain, people normally have two surnames, one from the mother and one from the father (no, it doesn't exponentially grow with generations :D). He had issues enrolling in uni, as the system required two surnames so he ended up with "Andres Schmidt Schmidt". He had issues down the road as well, having to explain himself every time he needed to register for something. I think the student id was also a hash which included the name and he hadn't been consistent with his "full" name in all systems.

Re: NULL license plate not such a bright idea

#484

Post by BrandoElFollito » Wed, Aug 21, 2019, 11:05 AM UTC

linker3000 wrote: post #132

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnec…

This is one reason why I stick to alphabet (+case) in my passwords, when I can make them long.

I had the exact same issues with some passwords which were accepted when creating them, then not accepted anymore when used to log in.

This plus emails such as a@example.com or hjghgfggv@example.someweirdtld show how much sites are broken because of some philosophical ideas of developers.