Live data from Hacker News

T-mobile password reset does not allow you to type the letter "V"

support.t-mobile.com

71–80 of 85 posts

Re: T-mobile password reset does not allow you to type the letter "V"

#71

I like to end my passwords with non-alphas like "!" Neither tmobile or at&t let me do this for whatever reason. Its incredible how telcos get away with everything from high pricing to shit web code. These are the mistakes of self-taught amateurs, not professionals.

Sometimes the restrictions are due to interfacing with legacy back-ends. No a great excuse, but at least more understandable.

Re: T-mobile password reset does not allow you to type the letter "V"

#72
post #23

Apparently to prevent paste. Their CheckEnter.js file has: function keyDown(a) { if (a.keyCode == 86) { a.preventDefault() } } And that's assigned to onkeydown... Funny enough, elsewhere in their code, they do explicitly check for Ctrl & V/C.

And why prevent paste? Just ran into this recently on paypal when I wanted to change my password. I generated one in passpack and tried to paste it in, no can do. Ridiculous.

I've changed password on one of my emails, typed it wrong in one input line, so I've ctrl+C and ctrl+V it from one input to the another. Stil didn't work, so I copied it the other way (I wasn't really thinking, then :)).

It worked, but I couldn't log in to that email for a few days, until I understood, that I've changed my password to

Re: T-mobile password reset does not allow you to type the letter "V"

#73
post #2

Wait till this guy figures out that T-Mobile also stores his password in plain text.

I wonder if it's a bad idea to disclaim that you store passwords in plain text (when you actually use PBKDF2 or something) to trick users into making more secure passwords.

Why would I bother making a secure password if it's stored in plaintext anyway?

Re: T-mobile password reset does not allow you to type the letter "V"

#74
post #44

This might be a good place to complain about -ed out passwords on mobile phones. It makes it next to impossible to enter a password(yes the last letter not -ed out for a few seconds only helps a tiny bit). If I'm not copy-pasting from keepass I'm entering the password in the login field then cut/paste it.

I think having the last letter visible for a very short time is a good balance. I certainly do not want the password to be visible in clear text. Shoulder surfing is an even bigger issue for mobile devices like phones or tablets -- which you routinely use in public and around strangers -- than it is for laptops or desktops.

Re: T-mobile password reset does not allow you to type the letter "V"

#75
post #64
post #32

Earlier quoted context omitted.

To say nothing about right click - paste... unless they're doing the 1999 thing and blocking right click too (and if they are, hopefully it's with a 1999-tastic alert("Right click not allowed!");).

Or click field. Go to the menu option Edit -> Paste. Let's see how they are going to dodge that with Javascript?

"You entered too many characters too quickly."

Re: T-mobile password reset does not allow you to type the letter "V"

#76
post #23

Apparently to prevent paste. Their CheckEnter.js file has: function keyDown(a) { if (a.keyCode == 86) { a.preventDefault() } } And that's assigned to onkeydown... Funny enough, elsewhere in their code, they do explicitly check for Ctrl & V/C.

And why prevent paste? Just ran into this recently on paypal when I wanted to change my password. I generated one in passpack and tried to paste it in, no can do. Ridiculous.

I guess this is software's version of security theater. Make the users feel like the website is secure because there is a javascript running on the login screen to prevent you from pasting, never mind that you can probably not use pass phrases or spaces because the backend was built in 1995. :)

Re: T-mobile password reset does not allow you to type the letter "V"

#77
post #69

Earlier quoted context omitted.

And MySQL? ;-)

I reckon that is nowhere near enterpricey enough. I would be very surprised to find anything less than the biggest Oracle db running that crap.

But then you can't blame silent truncation on varchar(15) fields.
Post reply on HN