Not all these seem like shameable rules.
Twilio for example is shamed for not allowing 3 x consecutive same character or the inclusion of the world ‘twilio’ in the password. That kinda just seems like reasonable password advice?
Dumb Password Rules: Shaming sites with dumb password rules
11–20 of 24 posts
Re: Dumb Password Rules: Shaming sites with dumb password rules
#12The ultimate sin is when a websites app doesn't support a password that the website does. Another favorite is when the change password requirements are higher than whats supported.
I had an android app refuse to log me in because of my email address, despite having an activated account for weeks.
Re: Dumb Password Rules: Shaming sites with dumb password rules
#13Not all these seem like shameable rules. Twilio for example is shamed for not allowing 3 x consecutive same character or the inclusion of the world ‘twilio’ in the password. That kinda just seems like reasonable password advice?
Well, neither of those things means a password is weak. Maybe they should check total entropy and if the password is already compromised and leave it at that.
Re: Dumb Password Rules: Shaming sites with dumb password rules
#14In case you haven’t seen it - the TreasuryDirect password policy is almost comical. There’s a screenshot in the repo.
The website disables the password input field (and password managers with it). To “type” your password, you have to use some on screen button-based keyboard monstrosity.
If someone wanted to make fun of password rules, this would have been great satire. But no - this is actually how you buy bonds from the US treasury.
Re: Dumb Password Rules: Shaming sites with dumb password rules
#15Twitter just changed their flow that breaks autofill from iOS password manager apps and also breaks with autofill of the username and password and TOTP authenticator code on the web browser with browser extensions. This is a big company with massive resources.
Re: Dumb Password Rules: Shaming sites with dumb password rules
#16By far the most frustrating password-handling sin I've encountered is when a website silently truncates the password field to some fixed length.
This is especially bad when you use a password-manager, as the password-manager will remember the full length password, which will be different than the truncated password the website is using. This wouldn't even be much of an issue if each website was at least consistent about truncating passwords, but often the account creation page and login page have different behavior (e.g. the account creation page truncates your password, but the login page doesn't, allowing your password manager to happily enter the full length password on the login page, thus resulting in a login failure).
The first couple times this happened I was perplexed, but I've been burnt by this so many times now that I've resorted to opening up my web browser's devtools on any account creation page to check the password for the maxlength attribute (because yes, many websites don't even mention the maximum length).
Re: Dumb Password Rules: Shaming sites with dumb password rules
#17Twitter just changed their flow that breaks autofill from iOS password manager apps and also breaks with autofill of the username and password and TOTP authenticator code on the web browser with browser extensions. This is a big company with massive resources.
It seems to be a dark pattern to discourage people to use multiple twitter account.
Re: Dumb Password Rules: Shaming sites with dumb password rules
#18I went to change a password for a website I hadn't used in years.
Tried to log in using my old password (that I had saved in password manager):
ERROR: "Your password is too short, please try again".
What had happened is they'd changed the password length requirement some time over the years, meaning I couldn't log in using my old password.
So I thought I'd try and out smart it doing a password reset.
ERROR: "Your old password is too short, please try again"
Re: Dumb Password Rules: Shaming sites with dumb password rules
#19Not all these seem like shameable rules. Twilio for example is shamed for not allowing 3 x consecutive same character or the inclusion of the world ‘twilio’ in the password. That kinda just seems like reasonable password advice?
Well, neither of those things means a password is weak. Maybe they should check total entropy and if the password is already compromised and leave it at that.
Password requirement:
Must have enough entropy.
Day 27, I'm still trying to type a password and it keeps telling me my password has low entropy and no apparent way to fix it.
Re: Dumb Password Rules: Shaming sites with dumb password rules
#20War is peace, freedom is slavery, ignorance is strength, and reducing the search space makes passwords more secure.
It's a bit counterintuitive but restricting search space like this when typing a password actually increases password entropy for most people, because people are dumb "123secret"