Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Electronic Arts Hates Strong Passwords

kaurkuut.com

Post reply on HN
Print view View original

41–50 of 111 posts

Re: Electronic Arts Hates Strong Passwords

#41

Post by irons »

David wrote: post #20
Derbasti wrote: post #7

Earlier quoted context omitted.

Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}

My bank limits you to 20 characters, which I'll grant is decent. But: NO non-alphanumerics, and, get this, is case insensitive . This may just convince me to switch banks...

American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.

Re: Electronic Arts Hates Strong Passwords

#42

Post by killerswan »

yason wrote: post #12

Someone heard "must validate all input", scratched his head for a while going about how to validate the password field, and thus came up with some artificial limitations? If so, it's a huge misconception about what it means to "validate" data. If not, someone's just really stupid. This goes into the same category as validating email addresses (just go ahead and send the confirmation email and watch me not replying in…

Double entry when setting a password, at least, is reasonable: a typo in a password field is going to be impossible for you to spot.

Re: Electronic Arts Hates Strong Passwords

#43

Post by fmw »

Revisor wrote: post #19

Unfortunately the silent limits of the password fields are very prevalent. I found out the hard way after I'd started to use Keepass to generate and manage my passwords. There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars. Obviously they don't even know why it matters. I think the developer j…

Limits on password length smell like plain text storage. Hashes tend to make the length of the password irrelevant (although some bad implementations only look at the first n characters of the string and ignore the rest), but when you store it in a relational database row you need to come up with some arbitrary limit.

Re: Electronic Arts Hates Strong Passwords

#45

Post by tomp »

OMG, that's all I can say.I'm no expert on security, but the few web sites that I wrote, I intuitively tried to do something as complicated as possible... e.g.

  md5('something silly' + password + 'qtjwtrb89ujq309')
Now, if I were to make an authentication system again, I would use custom salt for every user, something like

  sha1('random1' + username + 'random2' + password + 'random3')
This way, there is no way to use rainbow tables or something like that.

Re: Electronic Arts Hates Strong Passwords

#46

Post by redfloatplane »

My biggest surprise when resetting a bunch of passwords from the Sony hack was the fact that Paypal wouldn't let me use a complex password like the one in the article (no longer than 16 [or something like that] chars, no quotation marks, etc.

For another service, I would have thought that'd be okay - annoying, but okay. But a service with access to a whole bunch of my money? Not cool.

Perhaps it's changed since, but still, the fact that it once was that way is bad enough.

Re: Electronic Arts Hates Strong Passwords

#48

Post by LukeShu »

hackermom wrote: post #37

As for the "special characters" not being allowed, there is a sane and logical reason behind this (but whether or not EA's developers had this in mind will remain unanswered): the ASCII set is intuitively and easily available from any keyboard setup and locale in the world. Using special characters in your login/password, characters perhaps only available through your specific locale and keyboard - people living abro…

Oh, definitely. However, EA is disallowing characters that are standard characters in the ASCII set, for which they have no excuse: "/?~,.|\

Re: Electronic Arts Hates Strong Passwords

#49

Post by [deleted] »

tomp wrote: post #45

OMG, that's all I can say.I'm no expert on security, but the few web sites that I wrote, I intuitively tried to do something as complicated as possible... e.g. md5('something silly' + password + 'qtjwtrb89ujq309') Now, if I were to make an authentication system again, I would use custom salt for every user, something like sha1('random1' + username + 'random2' + password + 'random3') This way, there is no way to use r…

[deleted]

Re: Electronic Arts Hates Strong Passwords

#50

Post by keeperofdakeys »

Revisor wrote: post #19

Unfortunately the silent limits of the password fields are very prevalent. I found out the hard way after I'd started to use Keepass to generate and manage my passwords. There are even sites that have different limits for the "Change password" and "Enter password" input fields. Eg change accepts up to 30 characters but enter accepts only 20 chars. Obviously they don't even know why it matters. I think the developer j…

Myspace used to not check the length of passwords on signup, but would on changing password. You could log into the website with a long password, but whenever you tried to logon to the IM client (well, pidgin plugin), it would complain. It was a ten character limit I think.
Post reply on HN