3 ms·

Maybe password rules should be represented as an HTML5 attribute in the input field. 1Password and LastPass et. al. could read this rule and then adjust the pa

• tass 9y ago
  What reasons are there for these restrictions in the first place?
  • generj 9y ago
    The length requirements are logical if they have reasonable minimums and very high maximums. It doesn't make sense to limit special characters, etc. Especially as everyone should be using a password manager anyways. I suspect most of these odd requirements are a result of design by committee and pointy haired bosses. Maybe requirements from legal departments? As long as the annoying requirements are in place, we might as well try and get password mangers to work with them. LastPass has a generator which can be manually configured, but making the step automated would be helpful.
    • majewsky 9y ago
      > very high maximums What does "very high" mean here? And why would you need it? Usually, you just have a maximum request size in the web server, and people are never going to hit that with actual passwords.
      • ReidZB 9y ago
        Algorithms like bcrypt may have a maximum supported length: for bcrypt, over about 50 characters and things get dicey [1]. If you're running something computationally expensive like scrypt tuned properly, you don't want malicious entities to be able to send you a 32K password request, probably - easier to force them to keep it small (like < 50 chars), then block them based on request throughput. [1] https://security.stackexchange.com/a/39851/1373 https://security.stackexchange.com/a/39851/1373
• ma2rten 9y ago
  The only problem with that is that websites that have obscure password rules don't tend to be ones adopting modern HTML5 tags.