6 ms·

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At l

* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif https://blog.mamota.net/resources/img/wat_2.gif

gambiting 9y ago
Heh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.
- abainbridge 9y ago
  I hope you chose pa$sw0rd. The NHS online booking system my GP uses has rules like this. Pretty much guaranteed to prevent old people from being able to login.
- genpfault 9y ago
  > password must be between 7 and 8 characters long How do you enter a fractional character?
  - gruez 9y ago
    ranges in english (and probably other human languages) are usually inclusive on both sides.
  - pixl97 9y ago
    If there is a way, UTF-8 probably does it, incorrectly.
Klathmon 9y ago
The "must be changed every 30 days" always annoys me to no end. A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password. Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise. So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...
- iak8god 9y ago
  > So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do <password>, <password>1, <password>2, ...
  - fapjacks 9y ago
    Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.
    - iak8god 9y ago
      > Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". (╯°□°）╯︵ ┻━┻ I don't know how people who don't use password managers are able to deal with this kind of crap at all.
      - ajr0 9y ago
        ┬─┬ノ(º_ºノ) calm down, take it easy. they do not deal with it, they reuse passwords increasing the degree if the problem
      - bjpbakker 9y ago
        If a website warns me about this, I immediately remove my account. Because if they can tell how similar my new password is to my old password, it means they store information about my password. I do use a password manager however, so I don’t really notice.
    - JeanMarcS 9y ago
      So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ? I don't think so... So are your old passwords stored in plain text somewhere so they can compare ? Scary...
theophrastus 9y ago
And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got a direct contradiction.
- gregmac 9y ago
  I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.
  - setr 9y ago
    N choose 4 permutations of hashes could do it
    - lederhosen 9y ago
      Nah, that is only the character position sets to change, you also have to permutate the characters (which would be 2^(4*8) if we consider byte characters) Or did I misunderstand you?
      - setr 9y ago
        I was counting the number of hashes to store; im not sure why the size of each character would matter? But now that Im writing it out, I was clearly wrong anyways I thinking something along the lines of taking every substring of 4 characters, and then for all permutations of those 4-tuples, plug it back into the string hash and store. Assuming the goal is to not share any 4-substring with the new string So I think (N-4) + 1 gives you the number of 4-character windows 4! for the number of permutations of that 4-char window So 4!*(n-3) total hashes Which I guess is actually the same work you'd have to do anyways if you stored the plaintext; just without storing each variant

gambiting 9y ago

Heh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.

abainbridge 9y ago
I hope you chose pa$sw0rd. The NHS online booking system my GP uses has rules like this. Pretty much guaranteed to prevent old people from being able to login.
genpfault 9y ago
> password must be between 7 and 8 characters long How do you enter a fractional character?
- gruez 9y ago
  ranges in english (and probably other human languages) are usually inclusive on both sides.
- pixl97 9y ago
  If there is a way, UTF-8 probably does it, incorrectly.

Klathmon 9y ago

The "must be changed every 30 days" always annoys me to no end. A system I use not only has that requirement (along with a very insane set of requirements like "no patterns like 123 or ABC"), but they also NEVER let you reuse a password. Which means they have a database of every password I've ever used on a machine somewhere, hashed or otherwise. So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password...

iak8god 9y ago
> So the annoying workaround is to append year+month on the end of each password (which I was basically told to do when first setting up my account). So combined with a "maximum 10 characters" leaves 6 for my actual password... Or do <password>, <password>1, <password>2, ...
- fapjacks 9y ago
  Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". In particular, the US military won't let you set a password that is similar to the last ten of your passwords. What constitutes "too similar"? It seems that your new password can't have more than a three-character substring from your old passwords.
  - iak8god 9y ago
    > Ah, but nowadays there are sites that won't let you set a new password "if it is too similar to previous passwords". (╯°□°）╯︵ ┻━┻ I don't know how people who don't use password managers are able to deal with this kind of crap at all.
    - ajr0 9y ago
      ┬─┬ノ(º_ºノ) calm down, take it easy. they do not deal with it, they reuse passwords increasing the degree if the problem
    - bjpbakker 9y ago
      If a website warns me about this, I immediately remove my account. Because if they can tell how similar my new password is to my old password, it means they store information about my password. I do use a password manager however, so I don’t really notice.
  - JeanMarcS 9y ago
    So how do they know it's similar ? Is there a distance that could be calculated between 2 hashes and tell if they are similar ? I don't think so... So are your old passwords stored in plain text somewhere so they can compare ? Scary...

theophrastus 9y ago

And: "Must be four characters different than your last password" (this from a particular state's health insurance system). What does this mean? That four characters from the previous password must not appear in the new one at all, or only not in the same position? (fans of the little game Mastermind suffer deja-vu) What if the previous password contained all of the must have set of alternate symbols, then you've got a direct contradiction.

gregmac 9y ago
I can't think of a way to do that without actually storing the plain text password. If it is in fact plain text, the irony is that by enforcing such "strong" password requirements, they've actually made the overall system less secure.
- setr 9y ago
  N choose 4 permutations of hashes could do it
  - lederhosen 9y ago
    Nah, that is only the character position sets to change, you also have to permutate the characters (which would be 2^(4*8) if we consider byte characters) Or did I misunderstand you?
    - setr 9y ago
      I was counting the number of hashes to store; im not sure why the size of each character would matter? But now that Im writing it out, I was clearly wrong anyways I thinking something along the lines of taking every substring of 4 characters, and then for all permutations of those 4-tuples, plug it back into the string hash and store. Assuming the goal is to not share any 4-substring with the new string So I think (N-4) + 1 gives you the number of 4-character windows 4! for the number of permutations of that 4-char window So 4!*(n-3) total hashes Which I guess is actually the same work you'd have to do anyways if you stored the plaintext; just without storing each variant