6 ms·
I think nowadays the bigger problem is that sites don't cooperate with password managers. I am trying to use 20character passwords and some sites still limit th
by lousken 9y ago
I think nowadays the bigger problem is that sites don't cooperate with password managers. I am trying to use 20character passwords and some sites still limit that number to 12 or 16. Also the fact that blizzard or steam doesn't use TOTP that google auth. uses pisses me off.
- arkitaip 9y agoI still find sites that only allow 20 chars of a-zA-Z0-9. It should be criminal.
- knz 9y ago20? Haha, I've seen a limit of 10 this year (for my garbage collection company).
- ramchip 9y agoMy bank (SMBC) requires exactly 4 digits for the online banking password...
- teamhappy 9y agoYeah, for some reason banks and credit card providers seem to be worse at this than anybody else.
- rodolphoarruda 9y agoMine requires 6 digits to get in, but then for every real transaction I have to inform another 6 digits from an RSA app installed on my phone.
- jandrese 9y agoMy bank used to do that. They finally switched to a fancy Web 2.0 interface a couple of years ago that let you use real passwords.
- THE_PUN_STOPS 9y agoI have a password at work which is required to be EXACTLY eight characters, with no special characters. Took me a long time to come up with a password.
- JohnStrange 9y agoThat's secure enough if it's randomly generated.
- dspillett 9y agoYes, but the limit being present at all potentially highlights a problem and it may be one of many. You shouldn't need an upper limit to password/passphrase size and if you have to have one because something breaks otherwise then the site really is doing something wrong. If they are getting that so wrong, what else problematical is sat waiting for Mr Hacker to discover?
- jandrese 9y agoI ran across a site with the most insane password requirements awhile back: Some of this is from memory, so it might not be exact, but the requirements were: 1. Passwords must be exactly 14 characters long 2. Passwords must contain all 4 character classes (upper case, lower case, numbers, symbols) 3. Symbols must be from the set (! , . : ; " $ % & *) -- This wasn't specified, I had to figure it out from trial and error. 4. No more than two characters from any one class in a row (so aaBB is ok, aaaB is bad) 5. Passwords must be reset every 3 months 6. Passwords can not be similar to any previous passwords (it's vague what "similar" means) 7. Passwords must not be stored externally (IE, no copy/paste, no password managers) Luckily I don't have to use that system anymore, because it was just completely awful. To be fair, they also had smartcards that didn't require this password nonsense, so I think the requirements were partially to encourage people to use the smartcards instead.
- cuckcuckspruce 9y agoRelated problem: sites that don't let you paste into the password field - either when setting a password or trying to log in. To the people who do this: what do you think you're accomplishing? It's not going to stop somebody brute-forcing your site, and you're making it difficult to use a password manager.
- jrimbault 9y agoIn those cases, either I quit the site or, in a good mood, I open the dev tools...
- zzalpha 9y agoYeah, fortunately products like keepassx can auto-type into those fields, which works around the problem, but it's still absurd...
- dantillberg 9y agoMy favorite HN memory on this subject: https://news.ycombinator.com/item?id=4410350 https://news.ycombinator.com/item?id=4410350, "T-mobile password reset does not allow you to type the letter 'V'"
- pwg 9y ago> Related problem: sites that don't let you paste into the password field Run Firefox Change this about:config option "dom.event.clipboardevents.enabled" to "false". No more blocking of pasting into password fields by any site.
- throwfast1 9y agobeen awhile since I have played (star/war)craft/throne/wings of liberty but I recall that blizzard specifically ignored capital letters. I could enter my password in without capitals and it worked fine. any thought to why this may occur?
- lousken 9y agoI've never noticed that, because I never typed my password but I guess it's similar to what facebook[0] does in order to prevent caps lock issues? [0] https://security.stackexchange.com/questions/68013/facebook-password-lowercase-and-uppercase https://security.stackexchange.com/questions/68013/facebook-...
- vinceguidry 9y agoSites with stupid Javascript isn't half the problem that mobile is. I still can't make in-app purchases on my iPhone because every time I try, Apple makes me put in my security question answers, which are random strings just like the passwords are, and then I get "your request has timed out." Really I should be thanking Apple though for helping me save money.
- epistasis 9y agoI'm not familiar with the experience that you're describing; does an in-app purchase itself prompt security questions directly? Or do you need to reset your AppleID password and that's why you're getting security questions?
- jandrese 9y agoIt probably needed those questions answered once, but he can't answer them in time so his account is stuck in the "needs to verify" state.
- vinceguidry 9y agoI managed to get it once, somehow, only to be asked again the next time.