131–140 of 327 posts
We need another repo for stupid 2FA rules. Looking at you United Airlines.
Because it's totally not a bad thing to train users to accept unknown 2FA requests in the middle of the night because "it's probably just my work computer refreshing itself".
My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…
Earlier quoted context omitted.
> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?
> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.
The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed).
The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also able to login with 727796 or rARsYo or anything else that mapped to the same characters.
I really should have switched banks when I found this out.
Honestly, I'm past caring about upper length limits, however stupid they are. What really pisses me off is not validating on it, so my too-long password is happily accepted, and I have no idea what it is except that it's some prefix of the one I saved.
Reasonable upper limits don't bother me all that much. If you're going to store a hashed password, you want to choose an expensive hash algorithm (It's been a while since I looked at this, but I don't think bcrypt is standard anymore?) and that complexity is meant to be computationally ridiculous, and probably scales with length. Good security dictates a minimum length, and practical avoidance of your login form bein…
That way the input to your server-side hash function is fixed-length, whether the users password is 20 characters or 20 billion, and DOS attackers are only hurting their own computers.
Westpac, one of the largest banks in Australia have a 6 letter password requirement. No more. No less. Requires at least one number and no symbols allowed. Clearly not an IT focused organisation! The were also offered the .com version of their name for $1m AUD and turned it down which I found amazing for a $100bn organisation.
I use westpac here in New Zealand and their website works really well, normal password, normal inputs, nice looking UI... but IIRC they are technically different companys.
Strange to see a .gov.uk site on there ( https://github.com/dumb-password-rules/dumb-password-rules#h... ) as they have excellent guidance on this https://design-system.service.gov.uk/patterns/passwords/
From the GitHub issue about BMO: The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed). The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also abl…
Edit: Link to the github issue comment mentioned - https://github.com/dumb-password-rules/dumb-password-rules/i...
From the GitHub issue about BMO: The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed). The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also abl…