See also: http://plaintextoffenders.com
[deleted]
Bad Password Policies
31–40 of 45 posts
Re: Bad Password Policies
#32Please someone set up a tumblr for these. Paypal has a max of 20 chars.
I can't remember which site did it, but one site would just silently fail and redirect to the same page if the password was too long... awkward.
Re: Bad Password Policies
#33American Express also has 20 character limit, but for more fun they are case insensitive.
Re: Bad Password Policies
#34Earlier quoted context omitted.
Unless the website silently lowercases all passwords. A lot of them do, in the name of making life easier for people who have Caps Lock on.
IIRC Facebook creates three passwords to deal with character case issues; the one you enter, an inverted case version and a version with the first characters case inverted.
I'd be very surprised if they created all 3. They probably check the other 2 variations if the first one fails though:
if (entered == password || entered.swapcase() == password) .. // etcRe: Bad Password Policies
#35As soon as some characters are not allowed for passwords I always fear that the service did implement own hashing and password storage methods instead of using standard ones
Re: Bad Password Policies
#36I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
Twitter is also included in the list of annoying sites. I think AppleID is one too, their password policy just sucks anyway, I'd love to see the stats on the amount of "Forgot Password?"'s on their service
Re: Bad Password Policies
#37I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
Spaces do however sometimes cause some problems on html forms. For instance, they get trimmed off the end of each value of a form when the request is sent (happens on Chrome at least).
There was another gotcha I noticed with spaces and html forms once; an option in a select list with multiple consecutive spaces in the middle of it had those spaces reduced to one space when the request was sent (once again, happens on Chrome at least).
Re: Bad Password Policies
#38Honestly, I don't get why a service would enforce a password policy at all. They should warn users about what makes a good password, and tell them when their password sucks ("your password is weak and would be crackable in 3 minutes") but if someone wants for some reason to use 123456 as a password, that's their own problem.
The easiest answers I can intuit are a) space concerns and b) passwords being stored unencrypted. I reckon point a is valid because malicious users may attack the provider with very long passwords via creating bogus accounts, to disrupt the service; and b is valid because if the developers are lazy enough to store unencrypted passwords away, likely they are to defend against injection attacks via disallowing characters like (').
Re: Bad Password Policies
#39Please someone set up a tumblr for these. Paypal has a max of 20 chars.
Hetzner Robot is 32 IIRC.
Disappointing.
Re: Bad Password Policies
#40My bank does not allow me to choose a password with more than 6 chars (but that is only the log in, for any actual money transfers there is a factor-2-auth), and i think icq did limit the password to 8 chars. The only reason i can think of why one should do this is plausible deniability for the provider. No, we weren't hacked, your password just sucks.
This approach to "plausible deniability" can backfire easily. You made my password suck.