NXP has messed up their password form validation

I want to insert the "first time?" meme here.

Bad password fields like this are everywhere. Some of my favorites:

1. The ones that don't tell you what the restrictions are at all, just that your password is "wrong". 2. Tells you that a special character is required but doesn't tell you which ones are valid and which ones aren't. 3. Password requirements as stated do not match how the password field validates the password. (My favorite which I see a lot: Must be 20 characters or less... only accepts up to 19 characters.) 4. Allows only certain length of password on account creation, truncating the password your manager enters, but the login form password field is unlimited. 5. Silently truncates your password without telling you, even if you enter a longer password. 6. The ones that are either intentionally or unintentionally written such that somehow your password manager can't even find the form fields. Most especially the password field. 7. The ones that won't let you type or paste into them but instead give you an on-screen keyboard you have to key in your password with mouse clicks on a virtual keyboard for "security".

I could go on for days, but there's a lot of really badly written websites out there. At least in this case it was abundantly clear immediately that it didn't accept the bracket. I'd daresay call that login form good compared to some of the crap I've seen.

Well that didn't format how I wanted it to. Sorry about that to whoever reads this.

One of the funnier versions of this that I ran into was on Instacart’s change password form.

Years ago, they allowed very weak passwords. Eventually they implemented a complexity policy that required longer passwords, symbols etc. They applied client side validation of the complexity rules on their password change form, but they also applied the rules to the existing password. I ended up having to use burp suite to change the request inflight so as to set the correct current password.

It has been awhile (about 10 years or so), but I can recall at least two widely used enterprise access management systems that had trouble with some special characters. Access management is hard. Even those able to pour boatloads of cash into it don't necessarily get great results. On the other hand, there's nothing hard about providing users with a clear statement of your system's limitations. What ever happened to UAT?

Dumb clickbait headline. Sure it’s a dumb form but it’s hardly the first or terribly uncommon to have a limited set of expected special characters. And maybe jaded but my first assumption is that was a set, not an example.

Finance sites, utilities, I think the treasury all have something similar. Maybe this person is super young and doesn’t have to interact with crusty online services.