51–60 of 93 posts
I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.
Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwords too easy to guess like “no more than 8 characters”. e.g. > Coil > Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values. or Apple’s requirement that you cannot have more than 3 consecutive…
Some of these rules make sense. For example, bcrypt (still secure enough of you pick a decent amount of iterations, though you should really be using something more modern like argon2) will take a maximum of 72 bytes. In a Java, Javascript, or native Windows based system, that could easily mean a maximum of 36 characters unless you do some risky unicode conversion (UTF-16 to UTF-8). With unicode you can spend three b…
Note that most emoji are outside the BMP and will take four bytes per code point with both UTF-8 and UTF-16. Many are comprised of multiple code points.
Should be rule-centric rather than site thumbnail centric. I came to see dumb rules, not a bunch of thumbnails
I've never understood the sites with weirdly short limits ... like 6 characters, bonkers.
This becomes super relevant in dealing with FreeIPA with its yp/NIS server component supporting systems from the early 90s. NIS broadcasts the shadow file to the L2 every two minutes, and everyone's password is truncated to the first 8 characters. Hashcat cracked 30% of a 500 user shadow file in a few days on a GTX1060.
The French Family allowance is an interesting case. https://dumbpasswordrules.com/sites/caf-french-family-allowa... It looks crazy but actually I think they were trying to solve an insolvable issue. The population that will want to use this website is basically anyone who has children in France. That will include some very computer-illiterate people using god knows what public devices, some of them, very likely infec…
It's easy to watch someone unlock their phone with a PIN or gesture, steal the phone and open it later if the location of the keys never changes. Especially if the fingerprints are left on the screen.
If we can make this work with soft materials like rubber, it'd also be a defence against skimmers. It's trivial to see someone's PIN on a payment terminal even after they've already left the store if the keys don't immediately disappate body heat. Aim an infrared camera at the keypad and you'll see which keys were pressed, sometimes even in what order.
ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwords too easy to guess like “no more than 8 characters”. e.g. > Coil > Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values. or Apple’s requirement that you cannot have more than 3 consecutive…
ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
- must be a prime number - digits must sum to a number ending in 7