Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

251–260 of 327 posts

Re: Sites with dumb password rules

#251

Post by myself248 »

iamnotacrook wrote: post #228
notkaiho wrote: post #199

Earlier quoted context omitted.

I am actually appalled and baffled at American Express not applying case sensitivity. Like, what the actual.

I literally couldn't apply for an American Express card about 15 years ago because my (ISP) email address was too long. I wonder why they chose to restrict it rather than go with the standard email max length; they had to put effort in to pointlessly restrict new signups. Odd.

Back in '99 or so, there was a company called Halibut Stuff selling T-shirts at Defcon (and presumably other events) that included a free email redirect service with purchase of a shirt.

So I got a shirt that said "myself@iwenttodefcon7.andalligotwas.thislousyemailaddress.com"

Not too much later, I ended up working in software validation, and I broke so many login forms with that perfectly-valid address, I lost count.

Since then, Halibut Stuff dissolved and the forwarding service is long gone. If some HN reader wanted to set up a Mailinator-like service that generates absurd-yet-RFC-compliant email addresses for such testing, I think there might be a market.

Re: Sites with dumb password rules

#252

Post by Ayesh »

rurp wrote: post #81
jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

My local bank made a new website that does something similar, where the input for creating the password is truncated to be shorter than the field for entering the password. I forget the exact length but it is pretty short, like 10 characters. It took me forever to figure out why I couldn't log in to their new site.

Reading this and other similar experience, I wonder if one could make a browser extension (or vendors implement on the browser) to warn the user when they are typing behind the maxlength.

Re: Sites with dumb password rules

#253

Post by Ayesh »

Sylamore wrote: post #154
pwg wrote: post #103

Earlier quoted context omitted.

> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.

I used to set this permanently, but discovered if you use facebook making status updates and comments become broken due to how fb seems to scan your input to apply styling. But I often have to toggle it off temporarily to bypass the stupid copy/paste blocks.

You can create a bookmarklet to disable paste event listeners.

Re: Sites with dumb password rules

#254

Post by Ayesh »

ianlevesque wrote: post #241
transreal wrote: post #153

I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.

I have a credit card that requires you to answer a security question just to make a payment, with an existing linked account. I can't fathom what scenario they think they are protecting against here.

My former bank sends an SMS OTP every time I make a transaction. Not TOTP support. If it's the same security question, password managers can easily fill it out, no?

This SMS annoyance is a major reason why I left them.

Re: Sites with dumb password rules

#255

Post by veritas3241 »

jspash wrote: post #213
meerita wrote: post #212

If you want to have a good system of passwords, you have to let users put what they want? Not a big security risk for these? I understand that too many rules are stupid, but even if it is a minimum of characters and then freedom to choose the character composition that one wants is the best instead of forcing a rare combination. The only thing I hate from passwords is lenght. Most of the websites don't allow me to do…

I really hate it when a site will allow you create a password with more than 20 characters, but then silently truncates it on the server. I wish I could remember an example, but it slips my mind. So if you ever find yourself having trouble logging in with your 1pwd auto-generated password, try again with the first 20 characters. You just might get in!

I've seen that before (maybe a bank, maybe ADP back in the day). Really horrible UX.

Re: Sites with dumb password rules

#256

Post by t34543 »

Twisell wrote: post #217
y4mi wrote: post #210

Earlier quoted context omitted.

Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy

I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to…

Why would you get reported?

Re: Sites with dumb password rules

#257

Post by sontek »

I wouldn't publicly shame companies that might be regulated by slowing moving policies. Anyone who collects payments (any start-up that wants to stay around for long) is required to follow some form of PCI which currently still has really bad rules.

You can disagree with the rules but if you don't want to get in trouble, you have to follow them until they fix them.

Re: Sites with dumb password rules

#258

Post by marcosdumay »

pwg wrote: post #103
medmunds wrote: post #93

Earlier quoted context omitted.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.

Then you'll discover sites that consume your password by Javascript in the onKeyPressed event handler.

Re: Sites with dumb password rules

#259

Post by zAy0LfpBZLC8mAC »

loolatrix wrote: post #221
zAy0LfpBZLC8mAC wrote: post #60

Earlier quoted context omitted.

If only they were the only ones! Consorsbank (BNP Paribas) also has a limit of 5 chars, and comdirect even has a limit of 5 decimal digits. The IT security incompetence in banks in .de is just insane.

> comdirect even has a limit of 5 decimal digits Hm, sure? My comdirect account uses a 6 digits pin. Never tried to use more than that. But 6 were still horrible enough when looking at the fact, that SEPA transfers of up to 30 Euros don't require entry of a TAN. A feature, which can't be disabled. Hate comdirect for that move. EDIT: feature, not option. :)

Oh, oops, yes, you are right, it's 6 digits ... not that that really makes a difference, though ;-) (And yes, I tried, you can't use longer or non-digits ...)

And, yes, the forced TAN-less transfers is why I am closing down my accounts. That is, they forcing thid disfeature on me, and their impertinent reaction when I rejected their bullshit justification (essentially they calling me rude and therefore refusing any further conversation because I pointed out that "many customers like this feature" is not a reason to force it and the risk that comes with it on customers who don't like it).

Re: Sites with dumb password rules

#260

Post by dorgo »

Twisell wrote: post #217
y4mi wrote: post #210

Earlier quoted context omitted.

Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy

I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to…

> as a form of protestation

Me too. It's like a game: choose the easiest possible password given constraints.. My theory is: for each set of constraints there is always exactly one such password. Hard to prove, I know.

Post reply on HN