Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Electronic Arts Hates Strong Passwords

kaurkuut.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: Electronic Arts Hates Strong Passwords

#71

Post by tomp »

LukeShu wrote: post #53
tomp wrote: post #45

OMG, that's all I can say.I'm no expert on security, but the few web sites that I wrote, I intuitively tried to do something as complicated as possible... e.g. md5('something silly' + password + 'qtjwtrb89ujq309') Now, if I were to make an authentication system again, I would use custom salt for every user, something like sha1('random1' + username + 'random2' + password + 'random3') This way, there is no way to use r…

That's better, but still horribly broken. Sha1 and md5 simply aren't adequate for secure passwords, they are still broken too quickly. You should use bcrypt. http://codahale.com/how-to-safely-store-a-password/ explains why, and links to implementations of bcrypt in many environments/languages (in the opening when he says "Use bcrypt" a hundred times).

thanks. I had something like that in mind, but didn't know what it was called.

Re: Electronic Arts Hates Strong Passwords

#72

Post by starwed »

yason wrote: post #12

Someone heard "must validate all input", scratched his head for a while going about how to validate the password field, and thus came up with some artificial limitations? If so, it's a huge misconception about what it means to "validate" data. If not, someone's just really stupid. This goes into the same category as validating email addresses (just go ahead and send the confirmation email and watch me not replying in…

asking me to provide something twice (I'll just copypaste from the first field, thanks; would be more useful if you just printed a confirmation of what I wrote onto the next page).

Asking for something (normally a password or email) twice is for your benefit -- to guard against typos. There are many typos you might miss visual confirmation of, I'm fairly certain the type-twice method is a sound one.

Re: Electronic Arts Hates Strong Passwords

#73

Post by Havoc »

nettdata wrote: post #52

Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…

Even better somewhere in the EA/BFBC2 account creation process it _allows_ you to use special chars, but when you actually login via the game it fails with a useless error message ("Unable to login. Please try again."), leaving you clueless as to the reason. Googling it tells you to switch of your firewall etc.

Re: Electronic Arts Hates Strong Passwords

#74

Post by Revisor »

plamenv wrote: post #31

Can anyone explain why would you want a password longer than 16 characters? Even if it's unsalted, all lowercase letters and md5 hashed, it's impossible to bruteforce crack it. And people who use 16 character passwords are unlikely to have them all-lowercase-lettered so it's even worse for the crackers. Sure, the 16 char limit may be arbitrary but even if you make it 50, tomorrow some outraged blogger will be complai…

A better question is> Why WOULDN'T I want a password longer than 16 chars?

The longer the password, the more secure I feel, even if it's one day leaked as an unsalted MD5. And I don't care whether I can remember it because my password manager has effectively superseded my memory.

There is no reason to put an upper limit to the password length.

Re: Electronic Arts Hates Strong Passwords

#75

Post by elithrar »

Revisor wrote: post #70
killerswan wrote: post #42

Earlier quoted context omitted.

Double entry when setting a password, at least, is reasonable: a typo in a password field is going to be impossible for you to spot.

It may be more useful and helpful to either show the password in cleartext, or provide a button that unmasks the password. Double inputs tend to seduce the user to copy&paste.

> Double inputs tend to seduce the user to copy&paste.

Maybe for us geeks, but I think your Average Joe is more likely to just re-type it.

Re: Electronic Arts Hates Strong Passwords

#76

Post by windsurfer »

arkitaip wrote: post #4

The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.

The rules for my university are:

* 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed

Re: Electronic Arts Hates Strong Passwords

#77

Post by [deleted] »

zimbu668 wrote: post #68

I activated an ATM card once and the automated system told me for a PIN "Many of our customers are choosing their mother's birthday, please enter the month and day your mother was born." So, out of a keyspace of 10,000, they were shoehorning most of their users into a space of 365(366). I tried to enter something that was not a valid 4 digit date and the system rejected it. I had to call back and talk to a customer s…

[deleted]

Re: Electronic Arts Hates Strong Passwords

#78

Post by safeaim »

fmw wrote: post #43
Revisor wrote: post #19

Unfortunately the silent limits of the password fields are very prevalent. I found out the hard way after I'd started to use Keepass to generate and manage my passwords. There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars. Obviously they don't even know why it matters. I think the developer j…

Limits on password length smell like plain text storage. Hashes tend to make the length of the password irrelevant (although some bad implementations only look at the first n characters of the string and ignore the rest), but when you store it in a relational database row you need to come up with some arbitrary limit.

Hope you're not right, as Paypal only let's you use up to 22 chars if I'm not mistaken

Re: Electronic Arts Hates Strong Passwords

#80

Post by stoney »

Revisor wrote: post #70
killerswan wrote: post #42

Earlier quoted context omitted.

Double entry when setting a password, at least, is reasonable: a typo in a password field is going to be impossible for you to spot.

It may be more useful and helpful to either show the password in cleartext, or provide a button that unmasks the password. Double inputs tend to seduce the user to copy&paste.

I went through a phase of copy/pasting double inputs. That phase ended when I copy/pasted a mistake from the first input and it caused a whole lot of hassle sorting it out.

Now I just make myself type it twice. I tell myself it's for my own protection.

Post reply on HN