Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

101–110 of 327 posts

Re: Sites with dumb password rules

#101

Post by ineedasername »

yellowapple wrote: post #65
Thriptic wrote: post #35

The most hilarious rules I've encountered were for a large, well known US hospital: * Password must be EXACTLY 8 characters long * Password must start with a letter * You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters * Password cannot "resemble" username or past password

The "password must be exactly 8 characters" rule screams AS/400.

I worked on a VMS system that used 4. It was originally meant to be a PIN entered over the phone, then the internet came along and that interface was exposed to the web. But it's okay, after a few years they upgraded to 6.

Re: Sites with dumb password rules

#102

Post by ineedasername »

RandallBrown wrote: post #78
learnstats2 wrote: post #28

Earlier quoted context omitted.

I haven't checked lately, but I understood that Facebook passwords are case-insensitive.

They're not case insensitive, but they do allow for some casing mistakes. Flipped case (caps lock) or first character case is wrong (mobile input field) were both allowed. Not sure about now. The article I found about it was from 2014.

That seems bad, like philosophically it feels like a password and only that exact password should work. But rationally I can't see too much of a problem with this.

Re: Sites with dumb password rules

#103

Post by pwg »

medmunds wrote: post #93
duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

> My pet peeve is sites that block pasting

Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true).

Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.

Re: Sites with dumb password rules

#104

Post by ChrisSD »

zeta0134 wrote: post #20
OJFord wrote: post #11

Honestly, I'm past caring about upper length limits, however stupid they are. What really pisses me off is not validating on it, so my too-long password is happily accepted, and I have no idea what it is except that it's some prefix of the one I saved.

Reasonable upper limits don't bother me all that much. If you're going to store a hashed password, you want to choose an expensive hash algorithm (It's been a while since I looked at this, but I don't think bcrypt is standard anymore?) and that complexity is meant to be computationally ridiculous, and probably scales with length. Good security dictates a minimum length, and practical avoidance of your login form bein…

bycrypt has a limit of 72 bytes (not characters) and possibly less depending on the specific implementation. Theoretically this could limit you to only 18 characters if your password is utf-8 encoded emoji (4 bytes per character).

This can be worked around by the server hashing the password using a fast hash before passing it to bcrypt but this risks reducing the security of the password.

Re: Sites with dumb password rules

#106

Post by kube-system »

medmunds wrote: post #85

For a nice counterexample, check out login.gov, the unified authentication service that seems to be replacing individual approaches at many US government sites. Their password requirements: “It must be at least 12 characters long and not be a commonly used password. That’s it!” [1] Oh, and login.gov allows pasting from a password manager. [1]: https://login.gov/help/creating-an-account/how-to-create-an-...

They're following the US government's own (very good) standard: NIST 800-63.

It specifically bans most of these dumb practices listed in the OP.

No 'security questions', no password hints, no special character or other composition rules, no short character limits, no routine expiration dates.

The main idea is: let the user make the password they want, require two factor, and run their password against a list of known compromised passwords to make sure they don't pick something stupid.

Re: Sites with dumb password rules

#107

Post by klhutchins »

medmunds wrote: post #93
duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

Just to add. I'm Not sure if it's just a policy thing, but when a windows rdp session locks, pasting the password is blocked. Manually typing the password becomes a pain. I really hope anything that blocks pasting in forms has good reason, an not just psuedo security

Re: Sites with dumb password rules

#108

Post by ehsankia »

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

I've lost count of how many times I had to "fix" broken sites by editing the javascript manually client side.

Re: Sites with dumb password rules

#109

Post by ehsankia »

duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

That's awesome. This is a great idea, if there's any way to get sites to fix their stupid rules, it's by shaming them :)

Re: Sites with dumb password rules

#110

Post by dingo_bat »

klhutchins wrote: post #107
medmunds wrote: post #93

Earlier quoted context omitted.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

Just to add. I'm Not sure if it's just a policy thing, but when a windows rdp session locks, pasting the password is blocked. Manually typing the password becomes a pain. I really hope anything that blocks pasting in forms has good reason, an not just psuedo security

If you have a Microsoft or Logitech mouse you can map a button to a macro that types your password. It works well with rdp password fields.
Post reply on HN