Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

171–180 of 327 posts

Re: Sites with dumb password rules

#171

Post by newnewpdro »

yellowapple wrote: post #66
skunkworker wrote: post #32

Earlier quoted context omitted.

Add Chase to that list. They don’t offer TOTP and are vulnerable to cellular account takeover attacks.

My credit union has the same issue (no TOTP, only options for second-factor are email and phone call, with no way to disallow one or the other).

I didn't even bother enabling online banking with my local bank because of this. None of the local banks have a damn clue so I just use them as if it's 1995; ATM and IRL. I only use them for cashing checks though so it's no big deal.

E-Trade has a decent security story though. 2FA w/hw token, and they refund all ATM fees on the checking account so it's decent for general banking in addition to trading.

Re: Sites with dumb password rules

#172

Post by surdu »

I would include there ANY website that imposes a maximum limit on the password length ... And it's not like a reasonable 255 chars or something. I've seen limitations to 8 characters! Why would you do that ?

Re: Sites with dumb password rules

#173

Post by pvorb »

blackoil wrote: post #170
meuk wrote: post #168

I understand that you follow some misguided security guidelines that state that a password must contain special characters and have a length of at least X. What I don't understand is why sites use a maximum password length. They shouldn't save your password anyway, and only compare the hash, right?

Cost of calculating 10k character hash? IMO above 30 length serves no practical purpose.

Other than not annoying users by not allowing their 31 character passphrase.

Re: Sites with dumb password rules

#174

Post by OskarS »

meuk wrote: post #168

I understand that you follow some misguided security guidelines that state that a password must contain special characters and have a length of at least X. What I don't understand is why sites use a maximum password length. They shouldn't save your password anyway, and only compare the hash, right?

Yeah. It either means that they do, in fact, save your passwords and the column in the database has a fixed length. Or... I dunno... the backend is written in C and they store the password in a `char password[16];` before sending it off to be hashed.

Whatever the reason is, it's pretty darn stupid!

Re: Sites with dumb password rules

#175

Post by onion2k »

ehsankia wrote: post #108
jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

I've lost count of how many times I had to "fix" broken sites by editing the javascript manually client side.

The maximum length of text in a field could be (and should be if it's actually necessary) an attribute in the HTML. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in...

Re: Sites with dumb password rules

#177

Post by toper-centage »

usr1106 wrote: post #157
transreal wrote: post #153

I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.

Another nasty experience I had recently: On an account I hadn't used for ages and for unexplicable reasons was not covered by my pw manager they did not present me the security question for password reset. Instead they gave me the whole list and said answer the security question you had chosen at registration. Of course I didn't remember, the list had no option I would always pick.

That actually makes it slightly more acceptable to use security questions I guess.

Re: Sites with dumb password rules

#178

Post by OskarS »

blackoil wrote: post #170
meuk wrote: post #168

I understand that you follow some misguided security guidelines that state that a password must contain special characters and have a length of at least X. What I don't understand is why sites use a maximum password length. They shouldn't save your password anyway, and only compare the hash, right?

Cost of calculating 10k character hash? IMO above 30 length serves no practical purpose.

If that were the case, would the limits be so small? I mean, it's usually like "less than 16 characters" or something. The extra CPU time to raise that limit to, like, 128 or something would be totally insignificant (especially if they're using a key-derivation function after the hash, as they should be).

Re: Sites with dumb password rules

#179

Post by kortilla »

blackoil wrote: post #170
meuk wrote: post #168

I understand that you follow some misguided security guidelines that state that a password must contain special characters and have a length of at least X. What I don't understand is why sites use a maximum password length. They shouldn't save your password anyway, and only compare the hash, right?

Cost of calculating 10k character hash? IMO above 30 length serves no practical purpose.

>Cost of calculating 10k character hash?

Irrelevant compared to the rest of the operations done on the server.

Re: Sites with dumb password rules

#180

Post by julianwachholz »

transreal wrote: post #153

I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.

The name of my childhood pet was "FVrE9msW9DLBAx". Makes for fun conversations on the phone.
Post reply on HN