See also: http://plaintextoffenders.com
Bad Password Policies
21–30 of 45 posts
Re: Bad Password Policies
#22Honestly, I don't get why a service would enforce a password policy at all. They should warn users about what makes a good password, and tell them when their password sucks ("your password is weak and would be crackable in 3 minutes") but if someone wants for some reason to use 123456 as a password, that's their own problem.
For services where a user can only access their own account, I mostly agree. But sometimes one users' bad security practices can compromise other people's security, too. If you're sharing confidential data with other people - for example, via SpiderOak[0] - and any one of those people's accounts are "hacked," it doesn't matter how good your password is.
[0] I'd say Dropbox, but you shouldn't be putting confidential data in Dropbox.
Re: Bad Password Policies
#23I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
you can try camelCasing your passwords, same effect really
Passwords don't need to be legible in the first place. There's nothing wrong with correcthorsebatterystaple.
On the other hand, forbidding spaces is absolutely misguided.
Re: Bad Password Policies
#24I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
you can try camelCasing your passwords, same effect really
Unless the website silently lowercases all passwords. A lot of them do, in the name of making life easier for people who have Caps Lock on.
Re: Bad Password Policies
#25I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
I had this annoyance with FastMail[0], recently. They give this justification for their restriction:
FastMail provides a lot of different services over many
different protocols. To ensure that your password is
compatible with all of them, and the many (often
slightly buggy) clients out there, we only allow
the characters A-Z, a-z, 0-9 and !?@#$%^&*()-=_+[]{}.,:;/\|~"'`.
Re: Bad Password Policies
#26Any length and any character is a nice idea, but given an incompetent developer on the other side it can get worse. E.g. a frequent snippet you can find on the web for hashing a string in .NET uses things like Encoding.Default or even Encoding.ASCII. Those then change every Unicode character silently to a question mark, making a lot of potential passwords identical. Normalisation should also be considered and rarely is.
Re: Bad Password Policies
#27Earlier quoted context omitted.
you can try camelCasing your passwords, same effect really
Unless the website silently lowercases all passwords. A lot of them do, in the name of making life easier for people who have Caps Lock on.
IIRC Facebook creates three passwords to deal with character case issues; the one you enter, an inverted case version and a version with the first characters case inverted.
Re: Bad Password Policies
#28One of the most ridiculous password policies I ran into recently limited passwords to a maximum length of 8 characters. I was absolutely stunned. And for whatever reason, they also enforce that it must contain both a capital and lowercase letter and a number, plus a minimum length of six characters.
Re: Bad Password Policies
#29One of the most ridiculous password policies I ran into recently limited passwords to a maximum length of 8 characters. I was absolutely stunned. And for whatever reason, they also enforce that it must contain both a capital and lowercase letter and a number, plus a minimum length of six characters.
My university used to have a similar length restriction. When I enquired about it, it was because they unify the password across all their systems, and some of the systems are old.
Re: Bad Password Policies
#30My bank does not allow me to choose a password with more than 6 chars (but that is only the log in, for any actual money transfers there is a factor-2-auth), and i think icq did limit the password to 8 chars.
The only reason i can think of why one should do this is plausible deniability for the provider. No, we weren't hacked, your password just sucks.