151–160 of 327 posts
Earlier quoted context omitted.
Just to add. I'm Not sure if it's just a policy thing, but when a windows rdp session locks, pasting the password is blocked. Manually typing the password becomes a pain. I really hope anything that blocks pasting in forms has good reason, an not just psuedo security
If you have a Microsoft or Logitech mouse you can map a button to a macro that types your password. It works well with rdp password fields.
Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.
> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?
A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
Earlier quoted context omitted.
> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?
> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.
But I often have to toggle it off temporarily to bypass the stupid copy/paste blocks.
Earlier quoted context omitted.
> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?
I've noticed a number of sites now are doing something that interferes with the password manager (Lastpass in this case). Common problems are either that autofill doesn't work (even explicitly clicking autofill does nothing), or they put a button in the username/password field that's exactly where Lastpass puts its button, so it's impossible to click. I don't get it -- don't the sites want users to use more secure pa…
Earlier quoted context omitted.
Reasonable upper limits don't bother me all that much. If you're going to store a hashed password, you want to choose an expensive hash algorithm (It's been a while since I looked at this, but I don't think bcrypt is standard anymore?) and that complexity is meant to be computationally ridiculous, and probably scales with length. Good security dictates a minimum length, and practical avoidance of your login form bein…
Why not have one round of hashing in the browser? That way the input to your server-side hash function is fixed-length, whether the users password is 20 characters or 20 billion, and DOS attackers are only hurting their own computers.
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
From the GitHub issue about BMO: The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed). The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also abl…