5 ms·
As a developer, I'm wondering if there is ever any legitimate reason for this. Is it the laziness of properly escaping inputs on the part of the developer? Comp
by d_r 16y ago
As a developer, I'm wondering if there is ever any legitimate reason for this. Is it the laziness of properly escaping inputs on the part of the developer? Complying with some standard? Integrating with a legacy system?
My favorite part is when I'm not allowed to use a special character in my password.
It is still a good idea to strip leading/trailing spaces, however. Users may inadvertently include a space when copy and pasting, and some less computer-savvy ones may just include one by accident.
- pierrefar 16y agoI stopped counting the number of times I called up banks in the UK to give them grief over their "security". My favourite pet peeve is the Mastercard SecureID and Secured by Visa. Both allow only a few characters with just letters and numbers. I get furious that my very secure passwords are not allowed. One bank blamed the system, saying the reason it's doing it this way is because it's "American".
- sirn 16y agoDoes Verified by VISA works (or not working) the same everywhere? I thought each bank has to support it independently, so I'm only blaming my bank for requiring me to use exactly 6-digit numbers as my VbV password.
- hellweaver666 16y agoMy bank insists on a five digit numeric pin to login to the online banking. FIVE NUMBERS EXACTLY. I mean... seriously, WTF?
- pierrefar 16y agoAre they assuming you're too brain dead to remember more?
- pyre 16y agoOne number less and hackers would be all over them! Be thankful for that extra number! ;-)
- jrockway 16y agoBut you get locked out forever after three tries. Consider the PIN to be a convenient way to not have to call the helpdesk every time you want to access your account, not as a key used to secure your data for eternity.
- pjscott 16y agoI wonder how many people's PINs are the first few digits of pi, e, or the Fibonacci sequence.
- Tichy 16y agoMy vote would be on stupidity. Maybe there really was a time when getting it right was hard (COBOL with custom proprietary databases?), but it is not hard anymore. And seeing as it really is rather important, there simply is no excuse for not fixing it. Think about it another way: if they can't get even that right, what does it say about the rest of their IT systems?
- pornel 16y agoI think it comes from silly belief that some characters are "dangerous", i.e. application fails to escape data properly and tries to make up for it by forbidding anything that author can imagine to be useful in exploits.
- pyre 16y agoOr the author heard that you need to 'sanitize inputs' and equated that with trying to completely validate all incoming input (i.e. trying to figure out if a name is valid/invalid rather than just escaping it properly). Or the PHB saw that you could enter a character that 'no one' would have in their name, and demanded something like Amazon/eBay/<popular website that PHB uses> has on their forms.
- Symmetry 16y agoEven worse, accepting a password with special characters in the "Change Password" screen but having it not work when you try to log on with it.