4 ms·

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let yo

by dannib 11y ago

No, the most annoying is when you paste your password manager's auto generated long password and it silently get cut after 16 characters but successfully let you create your account. But now the login form doesn't have the same max-length property and your password will fail. Hopefully the reset password form is synced with the login form.

qb45 11y ago
Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.
- IanCal 11y ago
  > Sounds so insane I guess it must have really happened. That happened to me on either "verified by visa" or the mastercard equivalent. I had to reset my password a few times before I figured that one out. For those that haven't used this it's an extra password protected step that comes up sometimes when purchasing things with your card.
- Someone 11y ago
  Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me their limit, so I could set my password a third time to get something maximally secure.
  - smoothgrips 11y ago
    So, they emailed your password to you? Plaintext? They store passwords in plaintext? Paypal?
    - Someone 11y ago
      directly after you set it
- citruspi 11y ago
  > Sounds so insane I guess it must have really happened. I had it happen to me when changing a password on an Apple ID account 1-2 years ago. My password was accepted without an error and truncated to 32 characters.
lhecker 11y ago
Yikes... That's even worse. Well at least Microsoft stopped doing that and are now displaying a message that the password is too long instead of doing it silently.
tombrossman 11y ago
There's something about pasting vs typing that fails to give the user the necessary feedback and this has been a problem for a while. I faced this same issue years ago and I finally figured out my passwords were being truncated by hitting the 'forgot password' link and noting that the service emailed me the plaintext password (another problem but let's do one at a time) which was fewer characters. My original was 32 and the one they sent was far fewer. I emailed support to ask and they said 'oh yes, we limit the number of characters in your password'. There was no documentation or feedback on the page to tell you this if you pasted the password, but if after pasting you deleted the last character and then tried to re-type it, you would see the error. Pasting never triggered the tooltip telling you the issue. Now I try this each time I sign up for something which is a minor hassle but still much easier than the seemingly random failures I had been seeing. It also taught me to immediately sign out and test the services' password recovery functionality to weed out the ones storing plaintext passwords, so that's good.
- proactivesvcs 11y ago
  You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/ http://plaintextoffenders.com/
  - 0x49 11y ago
    This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.
    - sfilipov 11y ago
      If they can crack the database, what's preventing them from getting the key used to encrypt the database?
qb45 11y ago
Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted. Funnily, the admins apparently really cared about security very much, so they required users to change passwords every few months. It was possible to change asdfghjk to asdfghjkl and keep logging in with asdfghjk. I kid you not.
- mikeash 11y ago
  There is a bank which shall remain nameless (<cough>Schwab</cough>) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.
  - Retric 11y ago
    As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.
    - mikeash 11y ago
      I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?
    - Estragon 11y ago
      > As long as you throttle login attempts short passwords are fine. Not if the password-hash database leaks.
      - 11y ago
T01 11y ago
Paypal does this
dcosson 11y ago
No, the most annoying is when you're on ios and the app doesn't integrate with password extensions and has decided to disable pasting in the password field.

by dannib 11y ago

qb45 11y ago

Sounds so insane I guess it must have really happened. I had similar issue with paypal once. Their bank account number field expected to get N digits without spaces, so it was hard limited to N characters. Of course they didn't bother telling about that. When I pasted my number with some K space separators tossed between digits, the last K digits have been silently truncated. Boom, account locked.

IanCal 11y ago
> Sounds so insane I guess it must have really happened. That happened to me on either "verified by visa" or the mastercard equivalent. I had to reset my password a few times before I figured that one out. For those that haven't used this it's an extra password protected step that comes up sometimes when purchasing things with your card.
Someone 11y ago
Happened to me this week. "Luckily", they also implemented the "feature" where they can send you your password by email directly after you set it, so when I couldn't get in with the password I set, I reset the password, got a mail with a new password, logged in, changed the password to a new random long string, and this timeasked them to send the password to me. The password they sent was chopped off. That told me their limit, so I could set my password a third time to get something maximally secure.
- smoothgrips 11y ago
  So, they emailed your password to you? Plaintext? They store passwords in plaintext? Paypal?
  - Someone 11y ago
    directly after you set it
citruspi 11y ago
> Sounds so insane I guess it must have really happened. I had it happen to me when changing a password on an Apple ID account 1-2 years ago. My password was accepted without an error and truncated to 32 characters.

lhecker 11y ago

Yikes... That's even worse. Well at least Microsoft stopped doing that and are now displaying a message that the password is too long instead of doing it silently.

tombrossman 11y ago

There's something about pasting vs typing that fails to give the user the necessary feedback and this has been a problem for a while. I faced this same issue years ago and I finally figured out my passwords were being truncated by hitting the 'forgot password' link and noting that the service emailed me the plaintext password (another problem but let's do one at a time) which was fewer characters. My original was 32 and the one they sent was far fewer. I emailed support to ask and they said 'oh yes, we limit the number of characters in your password'. There was no documentation or feedback on the page to tell you this if you pasted the password, but if after pasting you deleted the last character and then tried to re-type it, you would see the error. Pasting never triggered the tooltip telling you the issue. Now I try this each time I sign up for something which is a minor hassle but still much easier than the seemingly random failures I had been seeing. It also taught me to immediately sign out and test the services' password recovery functionality to weed out the ones storing plaintext passwords, so that's good.

proactivesvcs 11y ago
You might be interesting in Plain Text Offenders' browser add-on. It warns when you're browsing a site that is known to store or send passwords in plain text: http://plaintextoffenders.com/ http://plaintextoffenders.com/
- 0x49 11y ago
  This site, while clever, is spreading potentially bad information. For instance, ive worked for plenty of companies that send out site-generated passwords. The password is stored encrypted and sent out once to the user. While not the most secure, an attacker still wont be able to get to all of the plaintext passwords if they cracked into the database.
  - sfilipov 11y ago
    If they can crack the database, what's preventing them from getting the key used to encrypt the database?

qb45 11y ago

Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted. Funnily, the admins apparently really cared about security very much, so they required users to change passwords every few months. It was possible to change asdfghjk to asdfghjkl and keep logging in with asdfghjk. I kid you not.

mikeash 11y ago
There is a bank which shall remain nameless (<cough>Schwab</cough>) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.
- Retric 11y ago
  As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.
  - mikeash 11y ago
    I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?
  - Estragon 11y ago
    > As long as you throttle login attempts short passwords are fine. Not if the password-hash database leaks.
    - 11y ago

T01 11y ago

Paypal does this

dcosson 11y ago

No, the most annoying is when you're on ios and the app doesn't integrate with password extensions and has decided to disable pasting in the password field.