My current massive pita is Adobe Cloud. Why do I need to rotate my password every 6 months for a photo editing app that has no credit card information associated with it (corporate account).
"that's what the platform team gave us" :D
Sites with dumb password rules
181–190 of 327 posts
Re: Sites with dumb password rules
#182Earlier quoted context omitted.
Another nasty experience I had recently: On an account I hadn't used for ages and for unexplicable reasons was not covered by my pw manager they did not present me the security question for password reset. Instead they gave me the whole list and said answer the security question you had chosen at registration. Of course I didn't remember, the list had no option I would always pick.
That actually makes it slightly more acceptable to use security questions I guess.
Normal users will probably try different question-answer combinations until they get a hit, submitting a lot of personal data in the process
Re: Sites with dumb password rules
#183Many complaints are that non-ASCII characters (which all but one European languages have natively) are not allowed. While I agree that allowing them would be good for password security past experience has made me paranoid. Not all systems handle non-ASCII the same way, so when you change browsers or they upgrade their system your password might no longer work. Today Unicode is used a lot so it gets better, but it's s…
Or if they need to connect from a foreign computer.
Re: Sites with dumb password rules
#184Re: Sites with dumb password rules
#185Would love to have a chrome plugin that shows the requirements next to the site login.
Re: Sites with dumb password rules
#186My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…
I've lost count of how many times I had to "fix" broken sites by editing the javascript manually client side.
What's your process of editing client side JS? Is there some method to capture scripts before they load so you can make your modifications?
Re: Sites with dumb password rules
#187Many complaints are that non-ASCII characters (which all but one European languages have natively) are not allowed. While I agree that allowing them would be good for password security past experience has made me paranoid. Not all systems handle non-ASCII the same way, so when you change browsers or they upgrade their system your password might no longer work. Today Unicode is used a lot so it gets better, but it's s…
That might have been an excuse in 1999, but I'm not sure it's still a valid excuse in 2019. This is why you should use utf8.
I recently debugged through a case where this was a problem with non-ASCII usernames. Through an upgrade of an underlying docker image the default system encoding changed from UTF-8 to ISO-8859-1 and nobody noticed. This even passed QA since they always create new users in their test cases and the bug only occurred if you wanted to log in as a user with a non-ASCII character that was created with an old version of the service.
That doesn't mean the fault was not on us. We should've made the encoding explicit rather than relying on the system default.
Long story short, encoding problems can be tricky, even in 2019.
Re: Sites with dumb password rules
#188I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
Yeah, I've seen a similar restriction on mother's maiden name =/
Re: Sites with dumb password rules
#189The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…
The one that actually tells you they store plaintext passwords is when it can't be close to previous passwords.
Re: Sites with dumb password rules
#190The most annoying rule that Microsoft and Nintendo use everywhere: Your password cannot contain your email address
If you say it like that it may make sense, however the email address that I often use (especially if you have to use exotic text entering device) is a@xxxxx.com.
End result: I'm banned to use the letter a in my password... how smart! It drives me really crazy.