Sites with dumb password rules • Hacker News Board

Re: Sites with dumb password rules

#211

Post by martin_a » Fri, Sep 06, 2019, 9:28 AM UTC

y4mi wrote: post #210

lbeltrame wrote: post #196

Earlier quoted context omitted.

Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characters for input but mingles them when actually stores them (the backend uses AD for authentication, but the password change goes through a custom web form). And of course then logging in doesn't work at all. It took me days to figure out what was going on. I have…

Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy

Same here. Using a base password and adding the month in which I changed it the last time. If somebody feels happy about that, so be it.

Re: Sites with dumb password rules

#212

Post by meerita » Fri, Sep 06, 2019, 9:31 AM UTC

If you want to have a good system of passwords, you have to let users put what they want? Not a big security risk for these? I understand that too many rules are stupid, but even if it is a minimum of characters and then freedom to choose the character composition that one wants is the best instead of forcing a rare combination.

The only thing I hate from passwords is lenght. Most of the websites don't allow me to do +40 char passwords. I generate everything with 1Password and I have to limit on most websites to under 20 characters.

Re: Sites with dumb password rules

#213

Post by jspash » Fri, Sep 06, 2019, 9:35 AM UTC

meerita wrote: post #212

If you want to have a good system of passwords, you have to let users put what they want? Not a big security risk for these? I understand that too many rules are stupid, but even if it is a minimum of characters and then freedom to choose the character composition that one wants is the best instead of forcing a rare combination. The only thing I hate from passwords is lenght. Most of the websites don't allow me to do…

I really hate it when a site will allow you create a password with more than 20 characters, but then silently truncates it on the server. I wish I could remember an example, but it slips my mind.

So if you ever find yourself having trouble logging in with your 1pwd auto-generated password, try again with the first 20 characters. You just might get in!

Re: Sites with dumb password rules

#214

Post by yreg » Fri, Sep 06, 2019, 9:36 AM UTC

Tepix wrote: post #202

United MileagePlus: They ONLY offer multiple choice questions for the security questions! Of course, for some questions none of the answers are correct (favourite artist etc). On the other hand it would be dumb to choose a correct answer that someone else could find out and then take over your account. Some of the questions have as few as 12 valid answers - e.g. "in which month...". Also in the select box where you p…

Why does everyone (including the big tech companies) pretend that security questions are secure and should even be mandatory?

It's mind-boggling to me.

Re: Sites with dumb password rules

#215

Post by meerita » Fri, Sep 06, 2019, 9:37 AM UTC

jspash wrote: post #213

meerita wrote: post #212

If you want to have a good system of passwords, you have to let users put what they want? Not a big security risk for these? I understand that too many rules are stupid, but even if it is a minimum of characters and then freedom to choose the character composition that one wants is the best instead of forcing a rare combination. The only thing I hate from passwords is lenght. Most of the websites don't allow me to do…

I really hate it when a site will allow you create a password with more than 20 characters, but then silently truncates it on the server. I wish I could remember an example, but it slips my mind. So if you ever find yourself having trouble logging in with your 1pwd auto-generated password, try again with the first 20 characters. You just might get in!

I never faced that, but that truncate would be silly: you kill all passwords and customers have to recover it and keeping creating new ones.

Re: Sites with dumb password rules

#216

Post by dfox » Fri, Sep 06, 2019, 9:40 AM UTC

seaish wrote: post #189

outworlder wrote: post #6

The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…

The one that actually tells you they store plaintext passwords is when it can't be close to previous passwords.

You can also implement that by just bruteforcing the previous hash with variants of the new password. IIRC Windows since 2000 implement these kinds of checks in exactly this way.

Re: Sites with dumb password rules

#217

Post by Twisell » Fri, Sep 06, 2019, 9:45 AM UTC

y4mi wrote: post #210

lbeltrame wrote: post #196

Earlier quoted context omitted.

Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characters for input but mingles them when actually stores them (the backend uses AD for authentication, but the password change goes through a custom web form). And of course then logging in doesn't work at all. It took me days to figure out what was going on. I have…

Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy

I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked.

The big payout was when we had an on-site formation from a third party and the teacher needed to create a corp account. He miserably failed to validate various secure combinations against policy (like 16+ length 5 words xkdc style). Being the only consultant associated, I just yelled across the room full of in-house IT guys "Just try Password1 it's gonna make it!"

Obviously it worked out ¯\_(ツ)_/¯

PS: Oh and nobody reported me for this "incident" I still don't know if it's out of shame, dumbness or because nobody wanted to actually get to work to change that policy.

Re: Sites with dumb password rules

#218

Post by cgriswald » Fri, Sep 06, 2019, 9:47 AM UTC

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

I regularly run into situations where my password on sign up is silently truncated (without being given a maximum char count) so at login I can’t just edit a field, I’ve got to guess how many characters of my password they actually use or reset it (and still guess).

Re: Sites with dumb password rules

#219

Post by jason0597 » Fri, Sep 06, 2019, 9:49 AM UTC

Natwest has a really annoying password system where you have to enter certain characters of your password. LLoyd's Has another system where you can create a password you like, and then you have to create another second password that they ask you to take certain characters from (e.g. 1st, 3rd, 9th character), oh, and it's alphanumeric too.

Re: Sites with dumb password rules

#220

Post by LegitShady » Fri, Sep 06, 2019, 9:50 AM UTC

lbeltrame wrote: post #196

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characters for input but mingles them when actually stores them (the backend uses AD for authentication, but the password change goes through a custom web form). And of course then logging in doesn't work at all. It took me days to figure out what was going on. I have…

DROP TABLE