Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A compilation of websites with dumb password rules

dumbpasswordrules.com

Post reply on HN
Print view View original

31–40 of 93 posts

Re: A compilation of websites with dumb password rules

#31

Post by thesuitonym »

SamBam wrote: post #18

Nice, but displaying this as a gallery seems to make it harder to quickly parse all of these. The rules are all just images some hard to read at that scale, and some cut off. If you click on one, you can't page to the next, you have to go back to the gallery and click on the next. Seems like it would be nice to have the actual set of rules next to each example, and to be able to page through the examples. I also find…

I bounced pretty quick, because as amusing as it was, seeing a site and then a cut-off sentence about why it was there was not the best presentation.

The splash page would make more sense if it had some brief description of why sites end up there--and maybe some guidance of making decent password rules.

Re: A compilation of websites with dumb password rules

#32

Post by madamelic »

gorjusborg wrote: post #12
gorjusborg wrote: post #9

I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.

Oh, and if you have a maximum password length, I don't trust you with my data.

Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration.

That one is a fun one to find out.

Re: A compilation of websites with dumb password rules

#33

Post by lelag »

The French Family allowance is an interesting case.

https://dumbpasswordrules.com/sites/caf-french-family-allowa...

It looks crazy but actually I think they were trying to solve an insolvable issue. The population that will want to use this website is basically anyone who has children in France. That will include some very computer-illiterate people using god knows what public devices, some of them, very likely infected with all malware known to mankind.

They came up with this: have people click on numbers whose place change all the time and whose real values (beside the image shown) are server side. They probably hoped that it would protect the users from at least basic keyloggers attacks.

Re: A compilation of websites with dumb password rules

#34

Post by [deleted] »

nodesocket wrote: post #16

The most absurd example is the US government TreasuryDirect[1]. No password input box to provide your password. You have to use an absurd virtual keyboard abomination. ProTip: Go into developer tools and just paste your password into the value attribute for the password form field. [1] https://dumbpasswordrules.com/sites/treasurydirect/

[deleted]

Re: A compilation of websites with dumb password rules

#37

Post by duxup »

In the late 90s I remember signing into my bank account and being sure I mistyped my password.

So I logged out and back in and discovered that capitalization didn’t matter… neither did the any characters after the first six characters. It was a large national US consumer bank.

I sent them an email. They actually updated their system about 3 months later.

Re: A compilation of websites with dumb password rules

#38

Post by duxup »

JasonFruit wrote: post #10

ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…

Most of those rules sound like rules that came about because of the first stupid rule.

Re: A compilation of websites with dumb password rules

#39

Post by throwaway742 »

duxup wrote: post #37

In the late 90s I remember signing into my bank account and being sure I mistyped my password. So I logged out and back in and discovered that capitalization didn’t matter… neither did the any characters after the first six characters. It was a large national US consumer bank. I sent them an email. They actually updated their system about 3 months later.

That's actually impressive that they took action.

Re: A compilation of websites with dumb password rules

#40

Post by leetrout »

jwestbury wrote: post #20
JasonFruit wrote: post #10

ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…

I saw some similarly obtuse password policies when working in the defense industry. A coworker who had spent much longer than I had in the industry showed me what he called "the waterfall method" of password generation. That is, your password would be something like 1Qaz2Wsx -- a waterfall down the keyboard, if you will. You could always tell when he was typing in his password by the staccato tapping of keys. Just fu…

Very common password methodology to remember the pattern on the keyboard like that.

The NIST guidelines are really good IMO.

Post reply on HN