4 ms·

I still find sites that only allow 20 chars of a-zA-Z0-9. It should be criminal.

by arkitaip 9y ago

knz 9y ago
20? Haha, I've seen a limit of 10 this year (for my garbage collection company).
- ramchip 9y ago
  My bank (SMBC) requires exactly 4 digits for the online banking password...
  - teamhappy 9y ago
    Yeah, for some reason banks and credit card providers seem to be worse at this than anybody else.
  - rodolphoarruda 9y ago
    Mine requires 6 digits to get in, but then for every real transaction I have to inform another 6 digits from an RSA app installed on my phone.
  - jandrese 9y ago
    My bank used to do that. They finally switched to a fancy Web 2.0 interface a couple of years ago that let you use real passwords.
- THE_PUN_STOPS 9y ago
  I have a password at work which is required to be EXACTLY eight characters, with no special characters. Took me a long time to come up with a password.
JohnStrange 9y ago
That's secure enough if it's randomly generated.
- dspillett 9y ago
  Yes, but the limit being present at all potentially highlights a problem and it may be one of many. You shouldn't need an upper limit to password/passphrase size and if you have to have one because something breaks otherwise then the site really is doing something wrong. If they are getting that so wrong, what else problematical is sat waiting for Mr Hacker to discover?
jandrese 9y ago
I ran across a site with the most insane password requirements awhile back: Some of this is from memory, so it might not be exact, but the requirements were: 1. Passwords must be exactly 14 characters long 2. Passwords must contain all 4 character classes (upper case, lower case, numbers, symbols) 3. Symbols must be from the set (! , . : ; " $ % & *) -- This wasn't specified, I had to figure it out from trial and error. 4. No more than two characters from any one class in a row (so aaBB is ok, aaaB is bad) 5. Passwords must be reset every 3 months 6. Passwords can not be similar to any previous passwords (it's vague what "similar" means) 7. Passwords must not be stored externally (IE, no copy/paste, no password managers) Luckily I don't have to use that system anymore, because it was just completely awful. To be fair, they also had smartcards that didn't require this password nonsense, so I think the requirements were partially to encourage people to use the smartcards instead.

I still find sites that only allow 20 chars of a-zA-Z0-9. It should be criminal.

knz 9y ago

20? Haha, I've seen a limit of 10 this year (for my garbage collection company).

ramchip 9y ago
My bank (SMBC) requires exactly 4 digits for the online banking password...
- teamhappy 9y ago
  Yeah, for some reason banks and credit card providers seem to be worse at this than anybody else.
- rodolphoarruda 9y ago
  Mine requires 6 digits to get in, but then for every real transaction I have to inform another 6 digits from an RSA app installed on my phone.
- jandrese 9y ago
  My bank used to do that. They finally switched to a fancy Web 2.0 interface a couple of years ago that let you use real passwords.
THE_PUN_STOPS 9y ago
I have a password at work which is required to be EXACTLY eight characters, with no special characters. Took me a long time to come up with a password.

JohnStrange 9y ago

That's secure enough if it's randomly generated.

dspillett 9y ago
Yes, but the limit being present at all potentially highlights a problem and it may be one of many. You shouldn't need an upper limit to password/passphrase size and if you have to have one because something breaks otherwise then the site really is doing something wrong. If they are getting that so wrong, what else problematical is sat waiting for Mr Hacker to discover?

jandrese 9y ago

I ran across a site with the most insane password requirements awhile back: Some of this is from memory, so it might not be exact, but the requirements were: 1. Passwords must be exactly 14 characters long 2. Passwords must contain all 4 character classes (upper case, lower case, numbers, symbols) 3. Symbols must be from the set (! , . : ; " $ % & *) -- This wasn't specified, I had to figure it out from trial and error. 4. No more than two characters from any one class in a row (so aaBB is ok, aaaB is bad) 5. Passwords must be reset every 3 months 6. Passwords can not be similar to any previous passwords (it's vague what "similar" means) 7. Passwords must not be stored externally (IE, no copy/paste, no password managers) Luckily I don't have to use that system anymore, because it was just completely awful. To be fair, they also had smartcards that didn't require this password nonsense, so I think the requirements were partially to encourage people to use the smartcards instead.