Texas Attorney General Password Rules

Post by byoung2 » Tue, Jul 22, 2014, 9:06 PM UTC

Post by titusjohnson » Tue, Jul 22, 2014, 9:49 PM UTC

byoung2 wrote: post #2

The EXACTLY 8 characters worries me, because it suggests that they are storing the password in plaintext in an 8 character column.

Post by steve_g » Tue, Jul 22, 2014, 9:59 PM UTC

titusjohnson wrote: post #4

byoung2 wrote: post #2

The EXACTLY 8 characters worries me, because it suggests that they are storing the password in plaintext in an 8 character column.

Probably stored in 9, 8-character columns, labeled "last_password_1", "last_password_2", etc, given #10.

Post by Brandon0 » Tue, Jul 22, 2014, 10:26 PM UTC

88e282102ae2e5b wrote: post #7

They're not necessarily storing passwords in the clear (though the Texas Secretary of State does[1], so it wouldn't surprise me). For example, when updating a password on Facebook, they check to see if your new password is similar to your previous one by creating several variants of the new password, hashing them, and seeing if the hash matches any of your old password hashes. [1] http://plaintextoffenders.com/post/6…

Post by StefanKarpinski » Wed, Jul 23, 2014, 12:45 AM UTC

cpncrunch wrote: post #9

Unfortunately these asinine password requirements occur quite often. It's basically an indication that the site itself has poor security, and they're requiring a strong password to mitigate that risk. Also, if they are storing the password in plain-text, then it doesn't really matter how many fucking special characters your users have in their passwords :) Also, users will just write down the password.