They also don't accept email addresses in tons of places that end in anything other than .com (or maybe, if you're lucky, .net)
Electronic Arts Hates Strong Passwords
11–20 of 111 posts
Re: Electronic Arts Hates Strong Passwords
#12Someone heard "must validate all input", scratched his head for a while going about how to validate the password field, and thus came up with some artificial limitations? If so, it's a huge misconception about what it means to "validate" data. If not, someone's just really stupid.
This goes into the same category as validating email addresses (just go ahead and send the confirmation email and watch me not replying in case I entered a bad address, instead of complaining I can't use plus or some other allowed character in it) or my phone number (if you're picky about formatting I can already give you 01234567890 if I want so just let me, in the first place, type in a nicely formatted "+44-123 4567890" or something that I like) or asking me to provide something twice (I'll just copypaste from the first field, thanks; would be more useful if you just printed a confirmation of what I wrote onto the next page).
Re: Electronic Arts Hates Strong Passwords
#13Does it matter if they're strong if all they're going to do is md5 them?
Long, random strings with weird characters are unlikely to be in any md5 dictionary, so you'd have to bruteforce it. MD5 is a fast algo so that shouldn't take long for short passwords, but it does provide some security. If you've chosen a strong password then bruteforcing isn't a concern, so the fact they hashed instead of encrypting (edit: used a weak hashing algo) won't matter.
It's better than nothing, but not much. The fact that they md5'd it at all suggests they were thinking about security, just not very hard or well.
Re: Electronic Arts Hates Strong Passwords
#14The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.
One site I used (I think it was T-Mobile) simply removed characters from your password without even telling you. That took me a while to figure out.
Re: Electronic Arts Hates Strong Passwords
#15The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.
Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}
Yes, I was just going to mention banks as well. I have dealt with multiple online banking systems for major banks that enforced ridiculously low maximum password lengths and alphanumeric-only restrictions. It's one thing for Electronic Arts to have not thought through this stuff, but another entirely when you're talking about a banking system.
Re: Electronic Arts Hates Strong Passwords
#16Windows Live also has a 16 character, restricted-character limit.
Even worse, if I remember correctly they silently truncate passwords longer than 16 characters. I wasted nearly an hour trying to log in when they started doing that.
They're not the only site to silently truncate passwords, unfortunately.
(I hope you're joking about spending an hour trying to log in, though.)
Re: Electronic Arts Hates Strong Passwords
#17Holy moly, that's really really hard to read agains that background.
Shameful plug for a tool I love: use Readable. It's like Readability, in that it strips all content other than the articles text and styles it to make it more readable (larger, aesthetic font), but unlike Readability (or perhaps more correctly, like Readability used to be), it's lightning fast.
Re: Electronic Arts Hates Strong Passwords
#18Just like sites that can't handle a capital letter in a username. What is your database doing?
Re: Electronic Arts Hates Strong Passwords
#19Unfortunately the silent limits of the password fields are very prevalent.
I found out the hard way after I'd started to use Keepass to generate and manage my passwords.
There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars.
Obviously they don't even know why it matters.
I think the developer just silently presumed that no one would enter such long passwords.
The problem is really prevalent.
Re: Electronic Arts Hates Strong Passwords
#20The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.
Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}
My bank limits you to 20 characters, which I'll grant is decent.
But: NO non-alphanumerics, and, get this, is case insensitive.
This may just convince me to switch banks...