4 ms·
Their generation isn't great. They should tweak the resulting password to ensure that it passes most common tests. I think I would enforce - 10 characters
by murbard2 11y ago
Their generation isn't great. They should tweak the resulting password to ensure that it passes most common tests. I think I would enforce
- 10 characters
- at least one punctuation
- at least one digit
- at least one upper case
- at least one lower case
By coercing the password to have this form you're losing a trivial amount of entropy, but you'll pass the vast majority of password policies.
Also add a nonce to the password generation (1, 2, 3, 4) so that you can change it if needed or required. No need to remember the nonce, just try a few until you can login.
- nfriedly 11y agoI don't remember where off the top of my head, but I'm pretty sure I've seen sites that had a "no punctuation in passwords" rule. I think at least one of them was a bank.
- murbard2 11y agoMakes sense, it's so their IT department can read it to you more easily over the phone.
- Zancarius 11y agoNespresso is one that immediately comes to mind as it's the most recent I've encountered besides my bank. I went to order some pods for my mum as a gift only to discover that their password restrictions were not only draconian but stupid. The moment a site prohibits punctuation (especially single quotes as they did) is the moment I suspect they're storing passwords in plain text. It's not directly related, but I'm reminded of this Hall of Shame I stumbled upon from some HN comment a few weeks ago: http://plaintextoffenders.com/ http://plaintextoffenders.com/
- capnrefsmmat 11y agoPwdHash only puts punctuation in generated passwords if the password you provide has it, so it tries to be smart.
- lqdc13 11y agoAlso, some sites have things like capital letter cannot be the first character. Punctuation can't follow a digit. At most 8 characters... The list goes on.