11–20 of 93 posts
>Restrict the inclusion of a % character. That's awfully specific that begs the question why it exists.
Because someone couldn't be bothered to parameterise their queries, and, as such, is explicitly rejecting characters which are used by some underlying language they're working with (or Windows environment variables, I suppose). Same reason you'll see dollar signs and quotes often disallowed.
I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.
ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
>Restrict the inclusion of a % character. That's awfully specific that begs the question why it exists.
to do so, requires 2fa push to okta
the push didnt come through
so i opted to insert the code manually
i opened the app to get the code but it was showing the push notification from before
i click yes to authorise, it gives an error and reloads back to same notification
i click back manually to try and get the code, it shows the code for a millisecond but then goes back to notification
restart app few times, no luck
i will try tomorrow again to update my password
> Coil
> Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values.
or Apple’s requirement that you cannot have more than 3 consecutive characters, seem reasonable to me. Certainly these rules ban perfectly fine passwords, but they’re a lot better than something like “must be between 8 and 16 characters and contain one uppercase, lowercase, number, and special character, but not these special characters, and it also cannot have an edit distance of 3 from your user ID”
Seems like it would be nice to have the actual set of rules next to each example, and to be able to page through the examples.
I also find having to page through the home page a little odd.
This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined. With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of…
Bcrypt is outdated but still widely used, I reckon.
ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
Just further proof, really, that overly restrictive password policy leads to users adopting insecure password practices. But we've known that for ages -- and, indeed, the password policies we were grappling with at work were in direct defiance of NIST guidelines about password policy.