>Restrict the inclusion of a % character. That's awfully specific that begs the question why it exists.
SQL queries that may contain LIKE?
A compilation of websites with dumb password rules
81–90 of 93 posts
Re: A compilation of websites with dumb password rules
#82In the late 90s I remember signing into my bank account and being sure I mistyped my password. So I logged out and back in and discovered that capitalization didn’t matter… neither did the any characters after the first six characters. It was a large national US consumer bank. I sent them an email. They actually updated their system about 3 months later.
That's actually impressive that they took action.
Better than nothing I guess. Sad that it required a customer complaining about it to fix a gigantic security hole.
Re: A compilation of websites with dumb password rules
#83My favourite was at one of the companies I worked for. The admin decided that users are not to be trusted to choose their own passwords and so you had to mail the admin to generate the password for you which you then could not change on your own -- you had to mail him again. The password had to be changed every month and an email would go to entire company to change passwords before the guy goes on vacation. I would…
What's the point of hiring professionals if you're not going to take their advice, and treat them as hostiles? I find it so strange that I hear about so many companies that actively work against themselves on here.
Re: A compilation of websites with dumb password rules
#84Hmm... NordVPN... "Password cannot be longer than 48 characters."
I think that's an acceptable rule? The longest password I've used was 30 characters. Does anyone need longer?
Re: A compilation of websites with dumb password rules
#85Earlier quoted context omitted.
Oh, and if you have a maximum password length, I don't trust you with my data.
Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration. That one is a fun one to find out.
Swiss bank Cler is guilty of this too, in a way.
At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.
Re: A compilation of websites with dumb password rules
#86Earlier quoted context omitted.
I bounced pretty quick, because as amusing as it was, seeing a site and then a cut-off sentence about why it was there was not the best presentation. The splash page would make more sense if it had some brief description of why sites end up there--and maybe some guidance of making decent password rules.
Thanks for the feedback, the gallery seems to be not well loved, so will be re-evaluated.
Maybe two views? I sort of liked the gallery tbh.
Re: A compilation of websites with dumb password rules
#87There is also the “password is too strong” twitter account, which has plenty of material to keep it active https://twitter.com/pwtoostrong
Re: A compilation of websites with dumb password rules
#88Such a website is immediately les funny when you live in a country where all institutions and banks have idiotic rules (namely France).
I will add our sites (Ameli.fr is already there) as well as banks.
One of the sites forbids to use your email username. In my case it is the single letter e. I had to decrease the length of the password to accommodate that, and the site was disappointed that I decreased the security.
It is truly infuriating that a problem that has a well known solution still triggers the "let's do it differently, to fuck with our customers" kind of reaction.
Re: A compilation of websites with dumb password rules
#89Earlier quoted context omitted.
I saw some similarly obtuse password policies when working in the defense industry. A coworker who had spent much longer than I had in the industry showed me what he called "the waterfall method" of password generation. That is, your password would be something like 1Qaz2Wsx -- a waterfall down the keyboard, if you will. You could always tell when he was typing in his password by the staccato tapping of keys. Just fu…
The hard part was always password generation. That we’ve spent decades trying to add abstruse rules and training people to “do it right!” rather than provide a mechanism speaks to the psychology of security people. Buy people a box of tiny dice; have them make a game of a new pass phrase… that they can actually remember. Eg, this box which fits in your palm — and gets ~50bits per shake. https://zmichaelgehlke.com/ima…
People don't want the mechanism either because the root problem is the misaligned incentives in that a secure password is always more work to use compared to an insecure password. Recently the push for passwordless authentication has been tackling that.
Re: A compilation of websites with dumb password rules
#90ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
> It would be fun to work out mathematically how much they're limiting the password space with these rules. Alright, you nerd sniped me, but I'm lazy so I just simulated it, this cuts down the password space by ~35%. I didn't take into account passwords with leading 0s in my sampling, but this shouldn't change the result by much. from collections import Counter from random import randint def is_valid(password: str) -…
Really the only place the amount of excluded password space matters is at the minimum length, which is conveniently brute forceable. Without padding 0's that comes to 91.63% valid, with padding 0's 91.42%. Smaller spaces are going to hit the repeat rules less often so the wide difference in percentages should be no surprise.