Bad Password Policies
davidpashley.com
Bad Password Policies
1–10 of 45 posts
Re: Bad Password Policies
#2I'm always scared when I see the maximum length limit in password. I expect they just put clear text in their DB. Otherwise why would they limit it? Any key deviation or hash function will give the same length, regardless of the password length. Scary ...
Re: Bad Password Policies
#3I'm always scared when I see the maximum length limit in password. I expect they just put clear text in their DB. Otherwise why would they limit it? Any key deviation or hash function will give the same length, regardless of the password length. Scary ...
The most frightening I've seen is interactive brokers. Passwords must be 6 to 8 characters, and symbols are forbidden. Strangely, usernames must be 8 or 9 characters (with additional restrictions: >2 letters, >2 digits, and must start with a letter).
Re: Bad Password Policies
#4I'm always scared when I see the maximum length limit in password. I expect they just put clear text in their DB. Otherwise why would they limit it? Any key deviation or hash function will give the same length, regardless of the password length. Scary ...
Maybe they're just trying to protect against denial-of-service attack through very long passwords[1]. Although 16 or 20 characters seem too short.
[1] https://www.djangoproject.com/weblog/2013/sep/15/security/
Re: Bad Password Policies
#5I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
Re: Bad Password Policies
#6Please do not enforce character set or maximum length restrictions. I have a number of 30+ -character passwords that are regularly rejected because they don't contain a digit. I'm sorry but "Password1" isn't going to be stronger than that.
Also, consider enforcing higher minimums. Eight characters is simply too fast to brute-force.
Re: Bad Password Policies
#7I have one question. Even if we use hashing and random salting, then should we make some max-limit on the password. Its not related to the length i want to store, its the length that system will convert to a hash. Will very long passwords be hashed in equal time ?
Re: Bad Password Policies
#8I find it extremely frustrating how many services (Microsoft included!!) won't allow me to use spaces in my passwords. Why on earth do they care which characters I choose for my passwords? So much for "correct horse battery staple"...
you can try camelCasing your passwords, same effect really
Re: Bad Password Policies
#9I think the OP should name and shame the site that takes passwords over a non-secure connection, stores them in plain text, and silently truncates long ones. Maybe that would get them to fix it.
Re: Bad Password Policies
#10In apps built on our Q Platform, the default "set password" screen actually encourages users to select a PASSPHRASE and displays several suggestions. When the app is online, the suggestions consist of three consecutive words in Yahoo News. If the app is offline, they are generated from a dictionary in the form MY NOUN VERB HIS NOUN or similar.
This should hopefully help more people choose strong passphrases.