Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sites with dumb password rules

github.com

Post reply on HN
Print view View original

61–70 of 327 posts

Re: Sites with dumb password rules

#61

Post by aaronchall »

txcwpalpha wrote: post #37
Thriptic wrote: post #35

The most hilarious rules I've encountered were for a large, well known US hospital: * Password must be EXACTLY 8 characters long * Password must start with a letter * You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters * Password cannot "resemble" username or past password

Sounds like they were using z/OS or RACF [1] mainframe as a backend. Oof. Unfortunately, it's not that uncommon. I've done security consulting work at a few major F500 companies that were using this and had those same password rules. At one of them, it got to the point where almost every security review meeting had to start with "yes yes we already know how bad the password are, don't bring it up, let's talk about so…

I suspect they want to be able to brute-force passwords if they really need to, in the event of a uncooperative or malicious employee, and these rules allow for that.

Re: Sites with dumb password rules

#62

Post by nwsm »

My fortune 100 company has the following internal account password rules:

-Must be 8 characters

-Must be all lowercase

-Must contain $ or !

-Must contain letters and numbers

I'm not joking.

Re: Sites with dumb password rules

#63

Post by yellowapple »

The credit union I use has pretty standard password rules (that is: decent by bank standards, i.e. pretty abysmal), but what really takes the cake is that the "Forgot Password" mechanism is driven not by a button or link or what have you, but...

...a checkbox.

Worse, this checkbox is exactly where one would normally expect the "Remember me" checkbox, so if you check it out of habit, you'll end up getting shoved into the password reset flow instead.

Re: Sites with dumb password rules

#64

Post by yellowapple »

OJFord wrote: post #11

Honestly, I'm past caring about upper length limits, however stupid they are. What really pisses me off is not validating on it, so my too-long password is happily accepted, and I have no idea what it is except that it's some prefix of the one I saved.

You'd think if they're fine with truncating the password on account creation, they'd also be fine with truncating it on login as well.

Re: Sites with dumb password rules

#65

Post by yellowapple »

Thriptic wrote: post #35

The most hilarious rules I've encountered were for a large, well known US hospital: * Password must be EXACTLY 8 characters long * Password must start with a letter * You must use exactly 3/4 of the following: upper case, lower case, numbers, one of three special characters * Password cannot "resemble" username or past password

The "password must be exactly 8 characters" rule screams AS/400.

Re: Sites with dumb password rules

#66

Post by yellowapple »

skunkworker wrote: post #32
jonahhorowitz wrote: post #19

We need another repo for stupid 2FA rules. Looking at you United Airlines.

Add Chase to that list. They don’t offer TOTP and are vulnerable to cellular account takeover attacks.

My credit union has the same issue (no TOTP, only options for second-factor are email and phone call, with no way to disallow one or the other).

Re: Sites with dumb password rules

#67

Post by ClumsyPilot »

webmaven wrote: post #15
oh_sigh wrote: post #12

It would be nice if there was a HTML standard for specifying password requirement data, like length ranges, valid/invalid characters, character type requirements(3 letters, 1 number, 1 special character), etc, so that password managers/generators could use it to always create a valid secure, valid password for you.

Useful idea, but I wouldn't it be exploitable by adversaries as well (eg. knowing those constraints would be helpful for generating dictionary attacks)?

good old security by obscurity

Re: Sites with dumb password rules

#69

Post by [deleted] »

jdelman wrote: post #47

My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York. I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figu…

[deleted]

Re: Sites with dumb password rules

#70

Post by bonestamp2 »

panarky wrote: post #14

Chase Bank: Must not include more than 2 identical characters (for example: 111 or aaa) Must not include more than 2 consecutive characters (for example: 123 or abc) First, they apparently mean repeating and not identical characters. But more importantly, perfectly random character strings frequently contain repeating and consecutive characters, so this rule must reduce the entropy of passwords. ------ Edit - Just si…

When you did your simulation did you use lowercase and uppercase letters? I ask because chase.com doesn't differentiate between the two. Seriously. If you have a chase account, try changing the case of some of your letters and you'll still login successfully.
Post reply on HN