231–240 of 327 posts
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
The interesting thing about some of these is that you can instantly spot instances where they are storing the password in clear text. For instance, case-insensitive passwords. EDIT: I guess they could be converting to lowercase (or uppercase) every time before hashing, as multiple people pointed out. If that's the case though... fine, let's pick one of the first instances in that site (not mentioning by name). Why ca…
They don't want to deal with angry customers who are "definitely entering the correct password but it's not letting me in".
I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
Another nasty experience I had recently: On an account I hadn't used for ages and for unexplicable reasons was not covered by my pw manager they did not present me the security question for password reset. Instead they gave me the whole list and said answer the security question you had chosen at registration. Of course I didn't remember, the list had no option I would always pick.
Many complaints are that non-ASCII characters (which all but one European languages have natively) are not allowed. While I agree that allowing them would be good for password security past experience has made me paranoid. Not all systems handle non-ASCII the same way, so when you change browsers or they upgrade their system your password might no longer work. Today Unicode is used a lot so it gets better, but it's s…
That might have been an excuse in 1999, but I'm not sure it's still a valid excuse in 2019. This is why you should use utf8.
For a user setting a password it is unfortunately still reality in 2019, even if probability to hit such a system is slowly decreasing.
United MileagePlus: They ONLY offer multiple choice questions for the security questions! Of course, for some questions none of the answers are correct (favourite artist etc). On the other hand it would be dumb to choose a correct answer that someone else could find out and then take over your account. Some of the questions have as few as 12 valid answers - e.g. "in which month...". Also in the select box where you p…
Why does everyone (including the big tech companies) pretend that security questions are secure and should even be mandatory? It's mind-boggling to me.
The person on the phone then just asked me a basic question about the policy, which I got right since I had the policy in front of me, and was then happy to change my password.
Fantastic... not.
Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.
Allegedly this protects against key loggers.
> BMO Bank of Montreal > Password must be exactly 6 characters long and no special character. I had an account with these guys. Their security is just ridiculous. 6 alphanumeric characters is all they'll accept! I mean, some of the entries on the list are bad, but this is a friggin major national bank in Canada with a piss-poor password requirement. This list needs to be segregated into different categories so we can…
For some reason I feel that the upcoming European payment services directive is only going to make this worse.
Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.
Amazon mails to change your password every three months. How does one come up new passwords every three months?
I use 1Password and even though I agree that forced password rotation is dumb, this makes it painless.