No password policy is as egregious as American Express http://www.techrepublic.com/blog/security/american-express-p...
Schwab.com has the exact same policy.
Electronic Arts Hates Strong Passwords
91–100 of 111 posts
Re: Electronic Arts Hates Strong Passwords
#92The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.
Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}
My school only gives you a four-digit numeric PIN, and it defaults to your birth date.
Re: Electronic Arts Hates Strong Passwords
#93Backblaze enforces a limit to password length as well. Not as short as 16 characters, but still -- in Backblaze's case, we're talking about a backup of all your personal data and keys to said data.
Re: Electronic Arts Hates Strong Passwords
#94Earlier quoted context omitted.
Double entry when setting a password, at least, is reasonable: a typo in a password field is going to be impossible for you to spot.
It may be more useful and helpful to either show the password in cleartext, or provide a button that unmasks the password. Double inputs tend to seduce the user to copy&paste.
An option to unmask is, IMO, the best option. Please never show passwords in cleartext by default. My thoughts on the matter: http://alanhogan.com/password-masking
Re: Electronic Arts Hates Strong Passwords
#95The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.
The rules for my university are: * 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed
Does your university have a mathematics department? … sigh
Re: Electronic Arts Hates Strong Passwords
#96Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…
As an end user, I could not care less about how robust the underlying architecture is or who inside the EA hierarchy is screwing things up. Bottomline is, weak passwords are being stored as unsalted md5 hashes, which is problematic.
Re: Electronic Arts Hates Strong Passwords
#97Having been an Online Architect brought in for a couple of major EA projects (other than this one) I can tell you that they have a very robust and secure centralized user account system available. The problem comes when you have so many different game teams with varying experience in online security that are allowed to basically implement it as they see fit, and basically "proxy" the account generation/creation proce…
As an end user, I could not care less about how robust the underlying architecture is or who inside the EA hierarchy is screwing things up. Bottomline is, weak passwords are being stored as unsalted md5 hashes, which is problematic.
I agree completely, and if I implied otherwise, that wasn't my intent at all.
I'm just trying to shed some light that it's not ALL of EA's games, as the headline of the article implies.
There are tools and services in place to allow game teams to implement proper passwords and authentication, and they weren't used in this case.
Re: Electronic Arts Hates Strong Passwords
#98The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.
The rules for my university are: * 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed
Mine are:
"The new password is to be chosen as a combination of alphabetics, digits and special characters. It must be eight characters long and contain one of the special printable characters (eg $ - ! : / = _). Normal alphabetic characters are case sensitive ie "a" is not the same as "A". Special characters may not appear at the beginning or end."
Re: Electronic Arts Hates Strong Passwords
#99Someone heard "must validate all input", scratched his head for a while going about how to validate the password field, and thus came up with some artificial limitations? If so, it's a huge misconception about what it means to "validate" data. If not, someone's just really stupid. This goes into the same category as validating email addresses (just go ahead and send the confirmation email and watch me not replying in…
asking me to provide something twice (I'll just copypaste from the first field, thanks; would be more useful if you just printed a confirmation of what I wrote onto the next page). Asking for something (normally a password or email) twice is for your benefit -- to guard against typos. There are many typos you might miss visual confirmation of, I'm fairly certain the type-twice method is a sound one.
Asking passwords twice is quite ok--even Unix does it; it's the other things sometimes asked twice which is totally useless. Most commonly it's something like having to retype your email address. Woot?! You can already see it in plaintext so you can just correct any errors there.
Re: Electronic Arts Hates Strong Passwords
#10016 character limit and at least some symbols... This is luxury compared to a lot of services, even online shopping or banking sites.
Not salting though, should be against the law.