Sites with dumb password rules • Hacker News Board

Re: Sites with dumb password rules

#271

Post by scrooched_moose » Fri, Sep 06, 2019, 2:23 PM UTC

y4mi wrote: post #210

lbeltrame wrote: post #196

Earlier quoted context omitted.

Mine is my workplace. They mandate changing the password every 3 months (so most people use post-its) and their password change utility accepts special characters for input but mingles them when actually stores them (the backend uses AD for authentication, but the password change goes through a custom web form). And of course then logging in doesn't work at all. It took me days to figure out what was going on. I have…

Just use an ultra secure password schema such as September2019@$ . They obviously want you to use it considering that policy

I use very secure passwords (32 character random) basically everywhere except for work because they are so aggressive about password rotation.

Work gets the equivalent of Banana1!, Banana2@, Banana3#....Banana9(, Banana1! (upper case, lower case, number, symbol, can't be previous 8 passwords) because we rotate constantly.

Re: Sites with dumb password rules

#272

Post by gumby » Fri, Sep 06, 2019, 2:23 PM UTC

medmunds wrote: post #93

duffn wrote: post #54

Hi, I made this. It seems like most of you are as enraged as I am about some of these password rules. They just flat out make me mad. It's not much, but I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. So, if you find any particularly egregious offenders, do your part and submit a PR. It may actually make a difference.

> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?

> My pet peeve is sites that block pasting

Safari users can install StopTheMadness which disables this and other such nonsense.

Re: Sites with dumb password rules

#273

Post by SkyBelow » Fri, Sep 06, 2019, 2:23 PM UTC

myself248 wrote: post #250

Twisell wrote: post #217

Earlier quoted context omitted.

I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to…

Oh yeah. Yeeeears ago, I was contracting for a telecom provider, and as a contractor, the process for getting logins to all the stuff I needed access to was onerous in some cases, nonexistent in others. So the employee who was sponsoring my presence in the building just said I could share his login. "The password is Apr1999!, if you happen to be the first one to log in when it expires, just change it to May1999! and…

>but it made a mockery of corporate IT.

Isn't corporate IT recursively defined as being a mockery of corporate IT?

Re: Sites with dumb password rules

#274

Post by softawre » Fri, Sep 06, 2019, 2:27 PM UTC

joshuaissac wrote: post #208

julianwachholz wrote: post #180

Earlier quoted context omitted.

The name of my childhood pet was "FVrE9msW9DLBAx". Makes for fun conversations on the phone.

It is better to pick names with actual words. An attacker can otherwise say that the answer is just a bunch of random characters, and there is a risk that a naïve customer support representative may accept it.

Ugh...

Re: Sites with dumb password rules

#275

Post by CathedralBorrow » Fri, Sep 06, 2019, 2:33 PM UTC

sbarre wrote: post #243

mandelbrotwurst wrote: post #188

Earlier quoted context omitted.

Yeah, I've seen a similar restriction on mother's maiden name =/

My mother (and many many women in this modern world) _goes by her maiden name_ so it's not exactly a secret. I always (politely) point this out when I'm dealing with a human at an institution who asks me for this information as part of the security process.

Yep, plus all the people who don't live in a culture where "maiden name" implies anything.

Re: Sites with dumb password rules

#276

Post by devn0ll » Fri, Sep 06, 2019, 2:36 PM UTC

Where I work they use RSA 2fa keys. I have the app on my phone. You would receive a link in the work email, and by clicking it, it would add the token to the RSA app and give you the 2fa keys every 30 seconds.

After a few months, I bought a new phone so I had to get a new link (I thought). But even the IT guys are saying: Nah man that's too hard. Just use the same link you received months ago.

It worked. There is no time-out on those links!!!!. A link we receive in a plain-text email!!! Some of our inboxes are shared / have a PA attached.

But nooooo, this is not a security problem AT ALL... :-(

Re: Sites with dumb password rules

#277

Post by del82 » Fri, Sep 06, 2019, 2:43 PM UTC

This is great! Definitely therapeutic to be able to name-and-shame frustrating password experiences. Is the goal to actually get these sites to change their dumb rules?

If so, I wonder whether it's worth adding a (politely-worded) summary at the top of the page describing why rules like these are dumb? Then the people responsible for these sites, most of whom are themselves probably not dumb but just mis- or uninformed, can learn from their mistakes.

Re: Sites with dumb password rules

#278

Post by argd678 » Fri, Sep 06, 2019, 2:53 PM UTC

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

E*Trade’s mobile app does the same thing, but you can’t edit the password field since it’s a native app. Website allows longer passwords than what their mobile app allows and just locked you out of your account after a few correct password entires. To make things worse, support tells you it’s due to your network.

Re: Sites with dumb password rules

#279

Post by bryanrasmussen » Fri, Sep 06, 2019, 2:56 PM UTC

dorgo wrote: post #261

bryanrasmussen wrote: post #132

Earlier quoted context omitted.

The only reason I can figure why anyone would do that is if at some point the password in the db was a varchar with a length and then they changed it but didn't change the frontend - big isolated development team problems.

afaik, passwords are not stored in databases. Only the hash of the password is stored. The database doesn't know and doesn't care about the length of the password.

Either the password or the hash of the password is stored, which it is depends on the age of the application, the skills of the developers and probably other factors that do not readily spring to mind.

However I am quite certain that not every solution has hashes of the password stored because every now and then I still get sites that tell me the password I chose has disallowed characters in it.

Re: Sites with dumb password rules

#280

Post by glitcher » Fri, Sep 06, 2019, 3:06 PM UTC

sbarre wrote: post #243

mandelbrotwurst wrote: post #188

Earlier quoted context omitted.

Yeah, I've seen a similar restriction on mother's maiden name =/

My mother (and many many women in this modern world) _goes by her maiden name_ so it's not exactly a secret. I always (politely) point this out when I'm dealing with a human at an institution who asks me for this information as part of the security process.

Even when a woman does change her last name after marriage, believing that her maiden name is somehow secret information in this day and age seems about as secure as "what street did you grow up on?", or "what was your high school mascot?". The root of the problem is believing that security questions are a good practice to begin with.