11–20 of 20 posts
The problem with really awful password interfaces lies mainly with big institutions (banks!) who are unlikely to be influenced by bloggers linked on hacker news. Ever since switching to a password manager (1Password in my case) I've become acutely aware of how many places have ridiculous restrictions on passwords (especially maximum lengths and character restrictions), and the worst offenders are invariably banks and…
It is a trade off, because you have the ability to use significantly more complex passwords that are harder to brute force or guess using personal information. Just don't forget that you are providing new attack vectors in the process. If they access your password store and you didn't know about it, how at risk would you be if they were to unlock all of your passwords?
Do you really understand how the password store and password generator work?
The problem with really awful password interfaces lies mainly with big institutions (banks!) who are unlikely to be influenced by bloggers linked on hacker news. Ever since switching to a password manager (1Password in my case) I've become acutely aware of how many places have ridiculous restrictions on passwords (especially maximum lengths and character restrictions), and the worst offenders are invariably banks and…
The problem with really awful password interfaces lies mainly with big institutions (banks!) who are unlikely to be influenced by bloggers linked on hacker news. Ever since switching to a password manager (1Password in my case) I've become acutely aware of how many places have ridiculous restrictions on passwords (especially maximum lengths and character restrictions), and the worst offenders are invariably banks and…
I just hope that one of their consultants' designers read my blog :-)
Why would you have to restrict the length at all? I could see something like a few thousand characters max, to avoid making it easy to strain the server, but other than that, you're not supposed to store it as is anyway, and if you hash it, the input length doesn't really matter... what am I missing?
Although maybe they aren't but they still want to make sure they meet some arbitrary standard of "randomness" to make it less "hackable."
Also, requirements to what characters must be used (at least one number, at least one upper case letter) doesn't do much to increase security I think. Just let me enter whatever I want.
The problem with really awful password interfaces lies mainly with big institutions (banks!) who are unlikely to be influenced by bloggers linked on hacker news. Ever since switching to a password manager (1Password in my case) I've become acutely aware of how many places have ridiculous restrictions on passwords (especially maximum lengths and character restrictions), and the worst offenders are invariably banks and…
It seems like the more secure you need your data to be, the worse their password restrictions are. Restrictions such as no special characters, or an arbitrary short length raises a red flag. It says they don't really know what they are doing, and it makes me wonder what else is broken.
http://stackoverflow.com/questions/13738141/blacklist-filter...
Earlier quoted context omitted.
It seems like the more secure you need your data to be, the worse their password restrictions are. Restrictions such as no special characters, or an arbitrary short length raises a red flag. It says they don't really know what they are doing, and it makes me wonder what else is broken.
And no SQL keywords allowed in passwords. Because they like to advertise that they don't bother escaping user input before concatenating sql strings to store plain text passwords in the database. http://stackoverflow.com/questions/13738141/blacklist-filter...
$db->execute("INSERT INTO USERACCOUNTS ('username','password') VALUES ('".$_POST['username']."','".$_POST['password']."')");
Earlier quoted context omitted.
And no SQL keywords allowed in passwords. Because they like to advertise that they don't bother escaping user input before concatenating sql strings to store plain text passwords in the database. http://stackoverflow.com/questions/13738141/blacklist-filter...
I'd bet that patterns like $db->execute("INSERT INTO USERACCOUNTS ('username','password') VALUES ('".$_POST['username']."','".$_POST['password']."')"); are more common than anyone wants to believe.