Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

111–120 of 327 posts

Re: Sites with dumb password rules

#111

Post by duffn »

rolltiide wrote: post #82
duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

Hi, this needs a checklist or ability to see severity of infractions because some of these edge cases are very dumb to elevate alongside the truly broken flows

This is a good idea. I’ll think about how to handle it.

Re: Sites with dumb password rules

#113

Post by hateful »

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

The time entry system at my job disables the later days of the week (anything after tomorrow's day of the week) in the week when you try to enter your time the next week, even if you've manually selected the previous week. So on Monday Wednesday forward is disabled. So I need to run jQuery('input').removeAttr('disabled') in the console!

Re: Sites with dumb password rules

#114

Post by leifmetcalf »

amanzi wrote: post #73
jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

I had this issue with Air New Zealand - one of their sites was truncating the password field on one of the pages, but not on another page. Took me ages to figure out why sometimes I couldn't log in.

Auckland Transport does the same thing

Re: Sites with dumb password rules

#116

Post by catdog »

tim1994 wrote: post #74
zAy0LfpBZLC8mAC wrote: post #60

Earlier quoted context omitted.

If only they were the only ones! Consorsbank (BNP Paribas) also has a limit of 5 chars, and comdirect even has a limit of 5 decimal digits. The IT security incompetence in banks in .de is just insane.

DKB (another German bank) has the same 5 digits rule...

They finally changed it to between 8 and 38 characters.

Re: Sites with dumb password rules

#117

Post by zAy0LfpBZLC8mAC »

catdog wrote: post #116
tim1994 wrote: post #74

Earlier quoted context omitted.

DKB (another German bank) has the same 5 digits rule...

They finally changed it to between 8 and 38 characters.

Which is clearly better, except ... what kind of incompetence hides behind that upper limit? Is their hashing function incapable of processing more than 38 bytes? Or is someone storing passwords in plain text?

Re: Sites with dumb password rules

#118

Post by colek42 »

txcwpalpha wrote: post #37
Thriptic wrote: post #35

The most hilarious rules I've encountered were for a large, well known US hospital: * Password must be EXACTLY 8 characters long * Password must start with a letter * You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters * Password cannot "resemble" username or past password

Sounds like they were using z/OS or RACF [1] mainframe as a backend. Oof. Unfortunately, it's not that uncommon. I've done security consulting work at a few major F500 companies that were using this and had those same password rules. At one of them, it got to the point where almost every security review meeting had to start with "yes yes we already know how bad the password are, don't bring it up, let's talk about so…

Still no excuse. They need to create a custom encoding that works with their backend that allows more flexibility is password choice. It is not that tough of a problem.

Re: Sites with dumb password rules

#119

Post by dewey »

ineedasername wrote: post #97

I thought it was fairly well established in the tech community that something like a sentence you can easily remember is better than a weird sequence of 12-20 letters, special chars, etc. But I very, very rarely see any site ever mention or require it or anything. How come it hasn't taken hold?

I think it’s established in the tech community that you use a password manager, then you don’t have to care how the password looks like or how easy it is to remember.
Post reply on HN