Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

261–270 of 327 posts

Re: Sites with dumb password rules

#261

Post by dorgo »

bryanrasmussen wrote: post #132
jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

The only reason I can figure why anyone would do that is if at some point the password in the db was a varchar with a length and then they changed it but didn't change the frontend - big isolated development team problems.

afaik, passwords are not stored in databases. Only the hash of the password is stored. The database doesn't know and doesn't care about the length of the password.

Re: Sites with dumb password rules

#262

Post by js2 »

With Fidelity, to authenticate yourself when you call in on the phone, you enter your username and password on the keypad. (They've recently also introduced a "voiceprint" method which bypasses that though.) You use asterisk on the keypad for special characters. One hopes they've hashed your password for storage in both its original and DMTF compatible formats. This may or may not be related to their dumb password rules.

Re: Sites with dumb password rules

#263

Post by js2 »

exabrial wrote: post #25

Want to DDOS somebody? Try their password incorrectly three times. Stupidest password rule ever. Rate limiting after 3 mis-attempts is understandable. That rate limit doesn't need to exceed 1m with passwords over 14 characters.

I accidentally DDOS'ed myself creating my ssa.gov account and now I'm pretty sure I've got to visit a physical SSA office with identification to create the account.

Re: Sites with dumb password rules

#264

Post by recrof »

darkkindness wrote: post #186
ehsankia wrote: post #108

Earlier quoted context omitted.

I've lost count of how many times I had to "fix" broken sites by editing the javascript manually client side.

What's your process of editing client side JS? Is there some method to capture scripts before they load so you can make your modifications?

chrome does have overrides in developer tools - it supports persistent script editation. https://developers.google.com/web/updates/2018/01/devtools#o...

Re: Sites with dumb password rules

#265

Post by joeframbach »

dorgo wrote: post #261
bryanrasmussen wrote: post #132

Earlier quoted context omitted.

The only reason I can figure why anyone would do that is if at some point the password in the db was a varchar with a length and then they changed it but didn't change the frontend - big isolated development team problems.

afaik, passwords are not stored in databases. Only the hash of the password is stored. The database doesn't know and doesn't care about the length of the password.

A human has to do the work to turn the password string into a hash and store the hash. At some point in time (or now, even), it's probable that they ... didn't hash the password.

Re: Sites with dumb password rules

#266

Post by slaymaker1907 »

duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

You should have an honor roll for companies which were bad but fixed their dumb password rules.

Re: Sites with dumb password rules

#267

Post by saint_abroad »

iamnotacrook wrote: post #230
Thriptic wrote: post #35

The most hilarious rules I've encountered were for a large, well known US hospital: * Password must be EXACTLY 8 characters long * Password must start with a letter * You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters * Password cannot "resemble" username or past password

"Password cannot "resemble" username or past password" So they're storing passwords in plaintext somewhere then? Otherwise how would they know?

Past passwords can be tested against past hashes.

Re: Sites with dumb password rules

#268

Post by dhmiller »

notkaiho wrote: post #199
duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

I am actually appalled and baffled at American Express not applying case sensitivity. Like, what the actual.

I remember when their max password length was 8 characters. It blew my mind that a (effectively) bank had such terrible requirements. At least they fixed that

Re: Sites with dumb password rules

#269

Post by the_angry_angel »

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

Early versions of Bitlocker on Windows suffered from this.

I'll let you figure out how I know this :|

Re: Sites with dumb password rules

#270

Post by mrlala »

greatpatton wrote: post #190

The most annoying rule that Microsoft and Nintendo use everywhere: Your password cannot contain your email address If you say it like that it may make sense, however the email address that I often use (especially if you have to use exotic text entering device) is a@xxxxx.com. End result: I'm banned to use the letter a in my password... how smart! It drives me really crazy.

>a@xxxxx.com

For when XXX is just not kinky enough for you.

Post reply on HN