Good idea. Hope the companies listed take notes.
One of the dumbest I've seen is when the username has password-like requirements, like insisting capital letters and numbers.
A compilation of websites with dumb password rules
21–30 of 93 posts
Re: A compilation of websites with dumb password rules
#22“ Also, this gibberish if you intentionally left the "confirm password" field empty and that's even after a en_US redirection.
请输入新的登录密码.”
While it’s unfortunate that the particular string is not localized (it means please enter new password), this is not gibberish. Other languages are not gibberish
Re: A compilation of websites with dumb password rules
#23ME Bank is the best: - Must be all numerals. - Be 7 to 20 digits. - Cannot have the same number three times in a row. - Cannot have four ascending or descending numbers. - Cannot have the same number appear more than five times. - Cannot have pairs next to each other if the second pair is one number higher. - Cannot be the same as 8 previous ones. It would be fun to work out mathematically how much they're limiting t…
I think they mean like 7879.
Re: A compilation of websites with dumb password rules
#24Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwords too easy to guess like “no more than 8 characters”. e.g. > Coil > Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values. or Apple’s requirement that you cannot have more than 3 consecutive…
> Also add an indicator or separate rating for requirements that make the passwords too easy to guess
This, naively[0], is all requirements except minimum length. Every requirement reduces the problem space for would-be attackers and increases the cognitive burden for users.
[0] I recognise that with many modern techniques, password-cracking utilises common patterns rather than a brute-force approach.
Re: A compilation of websites with dumb password rules
#25I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.
Disabling paste anywhere is a cardinal sin.
“We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”
Re: A compilation of websites with dumb password rules
#26This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined. With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of…
Cryptographic password hashing functions such as bcrypt have relatively low maximums. Bcrypt sits at 72 characters, which if you used 4-byte UTF-8 is pretty short, for example. Bcrypt is outdated but still widely used, I reckon.
I actually didn't know that about Bcrypt. Good to know! Thank you. Though, 72 (18 if using 4 byte) would still be better than 10.
Edit: Also as OWASP suggestions (I thought of it but wanted to verify if it was OK before I posted)... if you're using Bcrypt you could hash it with something like sha256 before running it through Bcrypt to get around the length limit.
Edit: mistyped "bit" instead of "byte" :(
Re: A compilation of websites with dumb password rules
#27The most absurd example is the US government TreasuryDirect[1]. No password input box to provide your password. You have to use an absurd virtual keyboard abomination. ProTip: Go into developer tools and just paste your password into the value attribute for the password form field. [1] https://dumbpasswordrules.com/sites/treasurydirect/
I was worried about this when I started using TreasuryDirect, but fortunately Kee[0], a KeePass-compatible browser extension, fills it in automatically so you don't have to bother with the virtual keyboard.
Re: A compilation of websites with dumb password rules
#28Re: A compilation of websites with dumb password rules
#29I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.
Disabling paste anywhere is a cardinal sin. “We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”
My favorite is when sites completely disable pasting my bank account number.
Oh, let me get out my bifocals and checkbook that I copying from... and definitely not my online banking we've had for two decades+.
Re: A compilation of websites with dumb password rules
#30I've never understood the sites with weirdly short limits ... like 6 characters, bonkers.