Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

121–130 of 327 posts

Re: Sites with dumb password rules

#121

Post by modeless »

medmunds wrote: post #93
duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

I'm a big fan of this browser extension "Don't fuck with Paste" https://chrome.google.com/webstore/detail/dont-fuck-with-pas...

Re: Sites with dumb password rules

#123

Post by Gustomaximus »

Westpac, one of the largest banks in Australia have a 6 letter password requirement. No more. No less. Requires at least one number and no symbols allowed.

Clearly not an IT focused organisation! The were also offered the .com version of their name for $1m AUD and turned it down which I found amazing for a $100bn organisation.

Re: Sites with dumb password rules

#124

Post by YeahSureWhyNot »

fun fact: amex online banking wont let you use exclamation mark ! but allows question sign ? amex foreign exchange website does exactly the opposite. apple and amex is why my 1 password to rule them all routine got destroyed and now i just trust chrome to generate and remember passwords and rely on my Google account to carry them across devices

Re: Sites with dumb password rules

#125

Post by elevenbits »

medmunds wrote: post #93
duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

I've noticed a number of sites now are doing something that interferes with the password manager (Lastpass in this case). Common problems are either that autofill doesn't work (even explicitly clicking autofill does nothing), or they put a button in the username/password field that's exactly where Lastpass puts its button, so it's impossible to click.

I don't get it -- don't the sites want users to use more secure passwords? That should mean encourage password managers, unless they imagine I'm gonna remember a 32 character random unique password for every website?

Re: Sites with dumb password rules

#126

Post by 13of40 »

Gustomaximus wrote: post #123

Westpac, one of the largest banks in Australia have a 6 letter password requirement. No more. No less. Requires at least one number and no symbols allowed. Clearly not an IT focused organisation! The were also offered the .com version of their name for $1m AUD and turned it down which I found amazing for a $100bn organisation.

I can beat that, actually. The administrator passwords on the catalog system at my local university library in the 90s were required to be exactly 5 uppercase letters, and were hashed with crypt() and stored in an unshadowed file.

Re: Sites with dumb password rules

#127

Post by pbreit »

medmunds wrote: post #85

For a nice counterexample, check out login.gov, the unified authentication service that seems to be replacing individual approaches at many US government sites. Their password requirements: “It must be at least 12 characters long and not be a commonly used password. That’s it!” [1] Oh, and login.gov allows pasting from a password manager. [1]: https://login.gov/help/creating-an-account/how-to-create-an-...

I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?

Re: Sites with dumb password rules

#128

Post by tryptophan »

twblalock wrote: post #115

TreasuryDirect, an official US government site for buying and selling Treasury securities, makes users enter their passwords via a clickable on-screen keyboard. The passwords are not case-sensitive either.

FYI, you can just open up the html inspector and delete the readonly = "readonly" on the input box and suddenly you can use a password manager to fill it in.

Re: Sites with dumb password rules

#129

Post by ddeck »

pbreit wrote: post #127
medmunds wrote: post #85

For a nice counterexample, check out login.gov, the unified authentication service that seems to be replacing individual approaches at many US government sites. Their password requirements: “It must be at least 12 characters long and not be a commonly used password. That’s it!” [1] Oh, and login.gov allows pasting from a password manager. [1]: https://login.gov/help/creating-an-account/how-to-create-an-...

I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?

It means it's shouldn't be on this list[1] for example, because it makes brute force guessing from a dictionary of common passwords easy.

- Of all the password databases breached in 2016, "123456" made up 4% of them [1].

[1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...

Re: Sites with dumb password rules

#130

Post by snowe2010 »

pbreit wrote: post #127
medmunds wrote: post #85

For a nice counterexample, check out login.gov, the unified authentication service that seems to be replacing individual approaches at many US government sites. Their password requirements: “It must be at least 12 characters long and not be a commonly used password. That’s it!” [1] Oh, and login.gov allows pasting from a password manager. [1]: https://login.gov/help/creating-an-account/how-to-create-an-...

I don't like that at all. 12 chars is much too long. And what does "not be a commonly used password" mean?

Can't tell if you're being sarcastic or not...
Post reply on HN