Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A compilation of websites with dumb password rules

dumbpasswordrules.com

Post reply on HN
Print view View original

61–70 of 93 posts

Re: A compilation of websites with dumb password rules

#61

Post by wongarsu »

diarrhea wrote: post #19
throwaway2016a wrote: post #6

This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined. With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of…

Cryptographic password hashing functions such as bcrypt have relatively low maximums. Bcrypt sits at 72 characters, which if you used 4-byte UTF-8 is pretty short, for example. Bcrypt is outdated but still widely used, I reckon.

Wouldn't this be easily solved by giving bcrypt the sha512 of the password?

Though 72 or 36 characters max really isn't so bad.

Re: A compilation of websites with dumb password rules

#62

Post by _fat_santa »

NickBusey wrote: post #25
gorjusborg wrote: post #9

I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.

Disabling paste anywhere is a cardinal sin. “We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”

I wonder, what is the rationale for this "security feature"?

Re: A compilation of websites with dumb password rules

#63

Post by jeroenhd »

cyborgx7 wrote: post #46
toastal wrote: post #5

Earlier quoted context omitted.

A lot of Japanese-based services don't let you go past 10 or 12 or 16 characters for some reason.

This is actually a problem plaguing old ports of Japanese video games, sometimes even to this day. The reason for this is that Japan uses a mixture of symbols that represent entire syllables (hiragana, katakana) and symbols that represent entire concepts (kanji). So they have a much higher density of information per symbol, at the expense of having a lot more symbols. Then, when the game gets localized, input fields…

For passwords this doesn't work, as the Japanese IME requires visual feedback to pick the right characters. As far as I understand, password fields don't support foreign script very well.

For other inputs like names you're definitely right, though.

Re: A compilation of websites with dumb password rules

#64

Post by cobrabyte »

The stupidest login I've seen to date is the US Treasury's TreasuryDirect website. You can create your account using your password manager that kicks out a secure password, but when you go to log in, you have to use a stupid virtual keyboard using your mouse, so you can't type your password in. You have to use your mouse to click buttons on a virtual keyboard.

Who sold this dumb 'solution' to the government?

edit: I see it's on their list already. Gosh, it's horrible.

Re: A compilation of websites with dumb password rules

#65

Post by mjochim »

MetaMalone wrote: post #50

I’m no cybersecurity analyst, but there’s a reasonable amount examples that don’t seem that out there to me. For those who get this better than I do, what would be the ideal set of password rules?

1. Make it long. 2. That's it.

I wouldn't want to claim that one ideal set exists. But this one comes close. There is an often-cited XKCD comic that illustrates this: concatenating random lexicon words into a long, letter-only password (no special characters needed at all) is usually a very good password strategy.

https://xkcd.com/936/

Anything beyond that, in terms of better IT security, does not involve better passwords, but rather e.g. 2FA, Hardware tokens.

Re: A compilation of websites with dumb password rules

#66

Post by Maken »

Encrust6221 wrote: post #7

> BBVA > Username is your national ID (easy to find) and your password must have up to 6 alphanumeric characters only. Insanity. How is a system like that remotely acceptable?

Many banks in Spain have the same exact restrictions. My guess is somebody sold the same shitty COBOL backend to everyone back in the 60s, and they keep running it with different HTML layers slapped on top.

Re: A compilation of websites with dumb password rules

#67

Post by duffn »

SamBam wrote: post #18

Nice, but displaying this as a gallery seems to make it harder to quickly parse all of these. The rules are all just images some hard to read at that scale, and some cut off. If you click on one, you can't page to the next, you have to go back to the gallery and click on the next. Seems like it would be nice to have the actual set of rules next to each example, and to be able to page through the examples. I also find…

Good feedback, thanks! Pagination through items would be a great addition and the gallery seems to be not loved, so will be re-evaluated.

Re: A compilation of websites with dumb password rules

#68

Post by duffn »

thesuitonym wrote: post #31
SamBam wrote: post #18

Nice, but displaying this as a gallery seems to make it harder to quickly parse all of these. The rules are all just images some hard to read at that scale, and some cut off. If you click on one, you can't page to the next, you have to go back to the gallery and click on the next. Seems like it would be nice to have the actual set of rules next to each example, and to be able to page through the examples. I also find…

I bounced pretty quick, because as amusing as it was, seeing a site and then a cut-off sentence about why it was there was not the best presentation. The splash page would make more sense if it had some brief description of why sites end up there--and maybe some guidance of making decent password rules.

Thanks for the feedback, the gallery seems to be not well loved, so will be re-evaluated.

Re: A compilation of websites with dumb password rules

#69

Post by throwaway2016a »

thesuitonym wrote: post #42
throwaway2016a wrote: post #6

This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined. With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of…

>from a UX perspective some of these rules may be best to only tell the user about if they actually trigger it. This is fine if you have reasonable password policies, but I've run up against incredibly frustrating password requirements that were hidden until I triggered them. The workflow went like this: Password manager generates a password, attempt to submit. "Password must be less than 20 characters" OK, regenerat…

Yeah, kind of a lesser of two evils sort of thing. Though immediate validation client-size would help. The best UX would be to just not have ridiculous rules like "cannot contain %"

I was referring more to the "cannot be the same as last 4" policy and things like really long password lengths (too long to expect a reasonable person to type in). If your max length is, say 500, you probably don't need to include it in a long list because a reasonable person would never hit 500.

Re: A compilation of websites with dumb password rules

#70

Post by throwaway2016a »

wongarsu wrote: post #61
diarrhea wrote: post #19

Earlier quoted context omitted.

Cryptographic password hashing functions such as bcrypt have relatively low maximums. Bcrypt sits at 72 characters, which if you used 4-byte UTF-8 is pretty short, for example. Bcrypt is outdated but still widely used, I reckon.

Wouldn't this be easily solved by giving bcrypt the sha512 of the password? Though 72 or 36 characters max really isn't so bad.

If you check out the Bcrypt section of OWASP[1] this is exactly what they suggest.

[1] https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor....

Post reply on HN