I wish there were a web standard for sites to describe their password policy in a machine-readable format. Password generators could generate compliant passphrases, and this site could be programmatically generated, which hopefully would become a wall of shame encouraging sites to improve.
A compilation of websites with dumb password rules
91–93 of 93 posts
Re: A compilation of websites with dumb password rules
#92Earlier quoted context omitted.
Oh, and if you have a maximum password length, I don't trust you with my data.
You can’t just let users paste in 18,000 characters you need to limit the password length somewhere. But I agree a limit less than 255 chars is insane.
> You can’t just let users paste in 18,000 characters
Thank you for speaking up. And here it is: I don't trust you with my data.
Passwords should not be stored in a database. Period.
So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size.
If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data.
Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.
Re: A compilation of websites with dumb password rules
#93I've never understood the sites with weirdly short limits ... like 6 characters, bonkers.
Descrypt is 8 characters. This becomes super relevant in dealing with FreeIPA with its yp/NIS server component supporting systems from the early 90s. NIS broadcasts the shadow file to the L2 every two minutes, and everyone's password is truncated to the first 8 characters. Hashcat cracked 30% of a 500 user shadow file in a few days on a GTX1060.
FreeIPA's NIS emulator does not provide password shadow maps at all, so I don't see how that's relevant.