For a steady stream of these, check out https://twitter.com/PWTooStrong
Sites with dumb password rules
51–60 of 327 posts
Re: Sites with dumb password rules
#52> Admiral: Restrict the inclusion of a % character. I guess the password is being used in a query template? Seems like a very bad idea.
Or the password is used in sprintf() ... I know at least one organization where this happened. The % was being stripped from passwords for that reason.
Re: Sites with dumb password rules
#53Not surprised to see Sparkasse (German Bank) here, their password rules are horrible, they cap it with 5 chars which is insane.
I hope if someone gets hacked they will be able to sue the them because of their archaic security practices.
p.s. would like to use this opportunity to also complain about their non-english English dashboard, god I hate it.
Re: Sites with dumb password rules
#54Hi, I made this.
It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad.
It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb.
So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.
Re: Sites with dumb password rules
#55Want to DDOS somebody? Try their password incorrectly three times. Stupidest password rule ever. Rate limiting after 3 mis-attempts is understandable. That rate limit doesn't need to exceed 1m with passwords over 14 characters.
Yup. Long ago, a high level person was fired. After that someone hit everybody's passwords enough to trigger account locks. It could only be fixed at the console.
Re: Sites with dumb password rules
#56Earlier quoted context omitted.
Not necessarily. They could run str.lower() on the password input before hashing and saving the hash. Then to verify the password, you just always run str.lower() on the input before calculating the hash.
You are right. But then it boggles my mind even more that one would go through the extra effort.
Why? I've done it before. This was an in-house program with little in the way of security implications. Forcing the case on the password greatly cut down the number of problems.
Since then I have seen a better solution: Try the password, if it fails try it with the case flipped. If that works it's a caps-lock error, they know the password, accept it.
Re: Sites with dumb password rules
#57Earlier quoted context omitted.
doesn't any rule decrease password entropy?
It's ironic that allowing low-entropy passwords (for example, one-character) can actually increase the available entropy. For example, if you set a minimum password length of six characters, an attacker doesn't even need to bother going through all of the 1 through 5 character combinations. The flip side of the coin is that, obviously, allowing low-entropy passwords will inevitably mean that some users will actually…
I have actually thought about this a lot and done some napkin calculations: using a set of about 93 characters the search space for 5 character passwords is about 7 gigabytes; combining all the possible passwords <= length 4 is only about 74 megabytes in comparison. I think that the entropy loss is insignificant.
Re: Sites with dumb password rules
#58I encountered the MLB.tv one the other day. I think they are a no special characters site.
Re: Sites with dumb password rules
#59It's also frustrating when they change password rules and invalidate existing passwords in the process. Yesterday I had to go through an inconvenient password reset because my bank no longer allows spaces in passwords. The password input inconspicuously removes spaces after you type them. It took several failed attempts before I realized what was happening.
I've hit that, also. I finally gave up and did a password reset. In setting the new password I find the new rules precluded the password I was using. Apparently that was enforced by editing the input.
I've also set a password that wasn't accepted by the login box, it explicitly stated there was an invalid character.
Re: Sites with dumb password rules
#60Not surprised to see Sparkasse (German Bank) here, their password rules are horrible, they cap it with 5 chars which is insane. I hope if someone gets hacked they will be able to sue the them because of their archaic security practices. p.s. would like to use this opportunity to also complain about their non-english English dashboard, god I hate it.
If only they were the only ones! Consorsbank (BNP Paribas) also has a limit of 5 chars, and comdirect even has a limit of 5 decimal digits. The IT security incompetence in banks in .de is just insane.