Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

T-mobile password reset does not allow you to type the letter "V"

support.t-mobile.com

Post reply on HN
Print view View original

51–60 of 85 posts

Re: T-mobile password reset does not allow you to type the letter "V"

#51

Post by agildehaus »

skanuj wrote: post #7

Try using special characters - It will just omit some special characters and save the password with that character omitted. And yes, T-mobile sent back my password in clear-text, and that's how i know.

I learned this too recently when my password, which starts with a special character, suddenly was being rejected.

Turns out they use a Javascript validator on passwords, not only at creation, but also when you're logging in (beats me as to why). I found a page on their site that doesn't do the check and I can login fine there.

Storing the password in plain text is absolutely inexcusable. I'm an idiot and my passwords are stored PBKDF2/SHA512 - not like it's difficult.

Re: T-mobile password reset does not allow you to type the letter "V"

#54

Post by reddiric »

naner wrote: post #31
MichaelGG wrote: post #3

Apparently to prevent paste. Their CheckEnter.js file has: function keyDown(a) { if (a.keyCode == 86) { a.preventDefault() } } And that's assigned to onkeydown... Funny enough, elsewhere in their code, they do explicitly check for Ctrl & V/C.

I wonder if Shift+Insert works... (is that only a Linux thing?) Or Rt-Click -> Paste.

Shift-insert has worked on Windows as far as I go back (3.1).

Re: T-mobile password reset does not allow you to type the letter "V"

#55

Post by kleiba »

ams6110 wrote: post #23
MichaelGG wrote: post #3

Apparently to prevent paste. Their CheckEnter.js file has: function keyDown(a) { if (a.keyCode == 86) { a.preventDefault() } } And that's assigned to onkeydown... Funny enough, elsewhere in their code, they do explicitly check for Ctrl & V/C.

And why prevent paste? Just ran into this recently on paypal when I wanted to change my password. I generated one in passpack and tried to paste it in, no can do. Ridiculous.

In situations where you have a textfield "enter password" and another textfield "re-enter password", it would probably make sense to prevent pasting into the second field iff you didn't paste into the first field.

Better yet, if you pasted it into the first field, the second field should become disabled.

This is because usually password fields are not in clear-text but display stars for letters, so you don't know if you accidentally mistyped the password. But if you pasted it in in the first field already, there's no reason you should have to paste it a second time.

Re: T-mobile password reset does not allow you to type the letter "V"

#56

Post by jlgreco »

jrockway wrote: post #43
BryanB55 wrote: post #37

I hate when people disable pasting in password fields. Some of my passwords are 50 character random strings stored in 1password and sometimes I need to copy/paste and can not do it (ahem, icloud). I usually end up disabling javascript if the page still renders without javascript.

Assuming you're on Linux, you can just pipe the input into "xargs xdotool type". Thanks to the keyboard abstraction in X, no program will ever be able to tell that you didn't just type that on a keyboard.

If you are on linux, chances are you can just middle-click.

Re: T-mobile password reset does not allow you to type the letter "V"

#58

Post by raverbashing »

naner wrote: post #31
MichaelGG wrote: post #3

Apparently to prevent paste. Their CheckEnter.js file has: function keyDown(a) { if (a.keyCode == 86) { a.preventDefault() } } And that's assigned to onkeydown... Funny enough, elsewhere in their code, they do explicitly check for Ctrl & V/C.

I wonder if Shift+Insert works... (is that only a Linux thing?) Or Rt-Click -> Paste.

In Linux selecting text and middle-click has saved me countless times

Re: T-mobile password reset does not allow you to type the letter "V"

#59

Post by SquareWheel »

tedunangst wrote: post #50
SquareWheel wrote: post #35

Earlier quoted context omitted.

I ran into this same problem. Had to use the Chrome Web Inspector to get around it. I believe it's a part of PCI compliance, but plenty of sites accept credit cards without that nonsense so I'm not sure. GetGamesGo.com does the same thing.

Please, in the future, whenever talking about PCI compliance, cite chapter and verse. There's more than enough wild speculation running around about it, all sorts of myths are repeated and propagated.

I asked a GetGamesGo employee about the pasting issue and that is what he told me. Let me get the full quote:

  "Cut/paste passwords – that’s a stipulation of PCI compliance. We could scrap it, but they ask for it. We have to be PCI compliant on card processing."
I provided as much information as I had available, I do not know the chapter/verse. Apologies if I spread any misinformation, I took this rep at his word.

Re: T-mobile password reset does not allow you to type the letter "V"

#60

Post by [deleted] »

rat87 wrote: post #44

This might be a good place to complain about -ed out passwords on mobile phones. It makes it next to impossible to enter a password(yes the last letter not -ed out for a few seconds only helps a tiny bit). If I'm not copy-pasting from keepass I'm entering the password in the login field then cut/paste it.

[deleted]
Post reply on HN