Sites with dumb password rules
github.com
Sites with dumb password rules
1–10 of 327 posts
Re: Sites with dumb password rules
#2It's correct, but with such a large scope of available options out there, such a giant demand for the tool, it's a behemoth that is slow to change and full of silly mistakes. It's an unfortunate reality and consequence of the world we live in.
Re: Sites with dumb password rules
#3You can always trust State Bank of India to pick the worst possible process and phrase. WTF is hacking characters ?
Re: Sites with dumb password rules
#4You can always trust State Bank of India to pick the worst possible process and phrase. WTF is hacking characters ?
Presumably something like “;. Characters that get used in XSS/SQLI. Totally the wrong defense, of course
Re: Sites with dumb password rules
#5You can always trust State Bank of India to pick the worst possible process and phrase. WTF is hacking characters ?
> WTF is hacking characters
Basically anything a scripting programming language might use as a comment or sigil. Putting 'we are probably calling exec() on your password' into writing though is a boneheaded move.
Re: Sites with dumb password rules
#6The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text.
For instance, case-insensitive passwords.
EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name).
Why can't it have spaces? Hashes don't care about this. Smells awfully like some string manipulation going on.
Why is it limited to 20 characters? Odds are that they are using VARCHAR(20) or variants. Hashes also don't care about this.
None of this is proof, but it smells really bad.
Re: Sites with dumb password rules
#7The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…
Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.
Re: Sites with dumb password rules
#8The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…
You can't be sure, they could lowercase all passwords (so during registration and after logging in) after they are entered.
Re: Sites with dumb password rules
#9The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…
They could be doing argon2(lowercase(password)). But you're right, it's unlikely that they're doing the wrong thing in the right way.
Re: Sites with dumb password rules
#10The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…
Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.
You are right. But then it boggles my mind even more that one would go through the extra effort.