Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A compilation of websites with dumb password rules

dumbpasswordrules.com

Post reply on HN
Print view View original

41–50 of 93 posts

Re: A compilation of websites with dumb password rules

#41

Post by duxup »

baal80spam wrote: post #13
JasonFruit wrote: post #10

ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…

This reads as if someone was throwing darts at the board with random rules.

More like they came up with one dumb rule…. and had to make the other rules to cover for it.

Re: A compilation of websites with dumb password rules

#42

Post by thesuitonym »

throwaway2016a wrote: post #6

This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined. With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of…

>from a UX perspective some of these rules may be best to only tell the user about if they actually trigger it.

This is fine if you have reasonable password policies, but I've run up against incredibly frustrating password requirements that were hidden until I triggered them. The workflow went like this:

Password manager generates a password, attempt to submit. "Password must be less than 20 characters"

OK, regenerate a new password at 19 characters. "Password must include at least one special character."

...OK, add special characters in the list. "Password cannot contain %."

If they just told me all of the rules at the beginning, I could have made sure my password worked the first time.

Re: A compilation of websites with dumb password rules

#43

Post by zmgsabst »

jwestbury wrote: post #20
JasonFruit wrote: post #10

ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…

I saw some similarly obtuse password policies when working in the defense industry. A coworker who had spent much longer than I had in the industry showed me what he called "the waterfall method" of password generation. That is, your password would be something like 1Qaz2Wsx -- a waterfall down the keyboard, if you will. You could always tell when he was typing in his password by the staccato tapping of keys. Just fu…

The hard part was always password generation.

That we’ve spent decades trying to add abstruse rules and training people to “do it right!” rather than provide a mechanism speaks to the psychology of security people.

Buy people a box of tiny dice; have them make a game of a new pass phrase… that they can actually remember.

Eg, this box which fits in your palm — and gets ~50bits per shake.

https://zmichaelgehlke.com/images/dicebox.jpg

Re: A compilation of websites with dumb password rules

#44

Post by jeroenhd »

Some of these rules make sense. For example, bcrypt (still secure enough of you pick a decent amount of iterations, though you should really be using something more modern like argon2) will take a maximum of 72 bytes. In a Java, Javascript, or native Windows based system, that could easily mean a maximum of 36 characters unless you do some risky unicode conversion (UTF-16 to UTF-8). With unicode you can spend three bytes on a character if you use the right (wrong) ones and that doesn't even touch the upper character codes that some systems can't represent. Upgrading systems to use modern hashing algorithms isn't always easy or even necessary as long as you pick your parameters well, but this does limit the input of your system.

Some special characters (èéòó etc.) will have two or three different unicode code points, and using them means the server needs to either decide to mess with your password to unify the characters or accept the binary input you've submitted and hope that your other devices will input the character in the same way.

That said, if my password can't contain emoji, I don't trust your system. I've had one important service once tell me that characters like &; were illegal, which makes sense... if you're planning to show the password in HTML and you don't trust your sanitizer.

I've even helped someone log into a web service that needed to have every ' or " be preceded by a \. Someone must've called mysql_real_escape_string on a password there...

Re: A compilation of websites with dumb password rules

#46

Post by cyborgx7 »

toastal wrote: post #5
creakingstairs wrote: post #4

IIRC a website for a train company in Japan requires exactly 8 letters as password even now. I can’t remember which though.

A lot of Japanese-based services don't let you go past 10 or 12 or 16 characters for some reason.

This is actually a problem plaguing old ports of Japanese video games, sometimes even to this day.

The reason for this is that Japan uses a mixture of symbols that represent entire syllables (hiragana, katakana) and symbols that represent entire concepts (kanji). So they have a much higher density of information per symbol, at the expense of having a lot more symbols.

Then, when the game gets localized, input fields for names and spacing for text displays are way too short for languages written in the latin alphabet.

I assume it's a similar cause here.

Re: A compilation of websites with dumb password rules

#47

Post by twawaaay »

My favourite was at one of the companies I worked for. The admin decided that users are not to be trusted to choose their own passwords and so you had to mail the admin to generate the password for you which you then could not change on your own -- you had to mail him again. The password had to be changed every month and an email would go to entire company to change passwords before the guy goes on vacation.

I would like to think we progressed a bit but recently I worked for another company which required that we use our company domain password to log in to test linux servers. The issue is that everybody has root access on those servers. I implored that it is not safe and there should be separate accounts to access those servers but of course nobody would hear it.

So I wrote a script which intercepted all logins and passwords of people logging in to our test servers and then sent to the manager responsible for it. Well... they wanted to fire me for "hacking" their servers and I had to explain to them that once you have root on a server there really is not much they can do to prevent me from stealing passwords.

The end was they did not understand anyway and I was barred from accessing test environments. They also changed the linux distribution and "hardened" it because the old one "must had security vulnerabilities".

Fortunately, I soon changed the job again.

Re: A compilation of websites with dumb password rules

#48

Post by reidjs »

gorjusborg wrote: post #12
gorjusborg wrote: post #9

I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.

Oh, and if you have a maximum password length, I don't trust you with my data.

You can’t just let users paste in 18,000 characters you need to limit the password length somewhere. But I agree a limit less than 255 chars is insane.

Re: A compilation of websites with dumb password rules

#49

Post by throwaway742 »

madamelic wrote: post #32
gorjusborg wrote: post #12

Earlier quoted context omitted.

Oh, and if you have a maximum password length, I don't trust you with my data.

Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration. That one is a fun one to find out.

T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN.

Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security

Post reply on HN