Why is this even a thing? Is there any reason, historical or otherwise that limits password length? You just have to hash the password—then everything is the same length, right? Am I missing something?
Sites with dumb password rules
281–290 of 327 posts
Re: Sites with dumb password rules
#282Earlier quoted context omitted.
The other day I called my insurance to reset my online password and couldn't remember the answers to any of the security questions (I shop around every year so I never had to call them since I registered my account with them). The person on the phone then just asked me a basic question about the policy, which I got right since I had the policy in front of me, and was then happy to change my password. Fantastic... not…
I realise it's not ideal, but it's an open question West you'd like them to do instead? Do you want them to refuse you service completely, for example?
MFA. Security questions are easily socially engineered, especially when you need to choose from a list. What city was I born? One of the easiest things to find out about a person.
Re: Sites with dumb password rules
#283Earlier quoted context omitted.
I once tried Password1 scheme as a form of protestation for a client corp account I'd connect every 2 month or so but that had a 1 month rotation policy (so that I actually had to change my password every time I connected to them). It worked... Obviously I changed it to something else but regularly tried if still worked. The big payout was when we had an on-site formation from a third party and the teacher needed to…
Oh yeah. Yeeeears ago, I was contracting for a telecom provider, and as a contractor, the process for getting logins to all the stuff I needed access to was onerous in some cases, nonexistent in others. So the employee who was sponsoring my presence in the building just said I could share his login. "The password is Apr1999!, if you happen to be the first one to log in when it expires, just change it to May1999! and…
If you make the system secure but unusable, the users will find a way to make it usable but insecure.
Re: Sites with dumb password rules
#284The most annoying rule that Microsoft and Nintendo use everywhere: Your password cannot contain your email address If you say it like that it may make sense, however the email address that I often use (especially if you have to use exotic text entering device) is a@xxxxx.com. End result: I'm banned to use the letter a in my password... how smart! It drives me really crazy.
Does your email server automatically proxy a+asdfasdf@xxxxx.com to you?
If it does, you can easily work around that limitation by signing up with a+microsoft@xxxxx.com
I try to do that for any sites that let me, both for ease of indexing, and if my leaked email ever gets found in a data breach, I know which source it came from.
Re: Sites with dumb password rules
#285Earlier quoted context omitted.
I am actually appalled and baffled at American Express not applying case sensitivity. Like, what the actual.
I remember when their max password length was 8 characters. It blew my mind that a (effectively) bank had such terrible requirements. At least they fixed that
The 8-character limit was probably because the web site was just a fancy front-end to some decades-old mainframe system. You'd be surprised the age of technology and software big banks rely on. They tend not to fuck with a working system, partly because their reputation and millions or billions of dollars are on the line, but also because no manager wants to be the reason for a critical outage.
Re: Sites with dumb password rules
#286I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
As far as my credit card company knows, the name of my kindergarten teacher is Danny DeVito and I met my wife in the upper atmosphere of Venus.
Re: Sites with dumb password rules
#287Re: Sites with dumb password rules
#288Earlier quoted context omitted.
The name of my childhood pet was "FVrE9msW9DLBAx". Makes for fun conversations on the phone.
It is better to pick names with actual words. An attacker can otherwise say that the answer is just a bunch of random characters, and there is a risk that a naïve customer support representative may accept it.
In order to deploy this successfully, the attacker would have to know that you used a random string...how would they know this without having access to the string itself?
Re: Sites with dumb password rules
#289I've been getting pretty annoyed by the "Security Questions" some sites have you setup. A client I work with gave me a vendor account, with a preset list of security questions I had to answer. One was 'What was the color of your first car?'. I typed in 'Red', and got an error that the entry needed to be at least 4 characters long.
I have a credit card that requires you to answer a security question just to make a payment, with an existing linked account. I can't fathom what scenario they think they are protecting against here.
Perhaps they're protecting themselves against you making an on time payment and not accruing any interest. ;)
Re: Sites with dumb password rules
#290Earlier quoted context omitted.
> I've actually had one company reach out to me after making it on the list and they made their password rules less dumb. That’s a huge win! My pet peeve is sites that block pasting, say, from a password manager (glaring at you, Costco signup page). Those sites don’t usually include “do not paste” in the listed requirements, so this doesn’t really work with your screenshot approach. Ideas?
> My pet peeve is sites that block pasting Firefox: about:config: dom.event.clipboardevents.enabled, toggle to "false" (default is true). Result: websites can no longer block you from pasting things into form fields on your own browser on your own computer.
I tried this, but this breaks some web apps where I need clipboardevents to work (e.g. Google Docs). There needs to be a more granular option for this somehow, possibly in a plugin.