3 ms·

Reminiscent of Amex's password policy (at least what it was a few years ago): can't use punctuation in your password, because those keys are less frequently use

Reminiscent of Amex's password policy (at least what it was a few years ago): can't use punctuation in your password, because those keys are less frequently used, and using them frequently in passwords will cause visible wear on the keys, indicating to an attacker with physical access to your keyboard which punctuation characters are in your password. Trying so hard, but failing so badly.

toomanybeersies 9y ago
"we require passwords to be a maximum of 8 characters, because if they were longer, people would forget them, and would have to write them down" I'm sure that has been said by some manager somewhere.
- Klathmon 9y ago
  Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords. When they started using computers, they were taught to NEVER write your password down and to do things like replace letters like I with numbers like 1 for security. Not only are those not true any more, but the opposite is recommended. Making a unique LONG password is much more important, and writing it down on a sticky note next to your monitor is arguably more secure from some threats than even something like LastPass.
  - TallGuyShort 9y ago
    Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.
    - Klathmon 9y ago
      Oh I absolutely 100% agree, I just wanted to point out that sometimes a lot of these seemingly crazy reasons come from somewhere, and that as developers that might work with product managers like this, it's our job to help teach them. But maximum lengths (that aren't measured in kb) are a monumentally stupid thing, as are most other password "rules" (No, disallowing words in your password is not a good idea...) Provide a minimum length, and check passwords against common password lists, and use a damn good hashing algorithm with a process in place to easily allow upgrading that hash.

toomanybeersies 9y ago

"we require passwords to be a maximum of 8 characters, because if they were longer, people would forget them, and would have to write them down" I'm sure that has been said by some manager somewhere.

Klathmon 9y ago
Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords. When they started using computers, they were taught to NEVER write your password down and to do things like replace letters like I with numbers like 1 for security. Not only are those not true any more, but the opposite is recommended. Making a unique LONG password is much more important, and writing it down on a sticky note next to your monitor is arguably more secure from some threats than even something like LastPass.
- TallGuyShort 9y ago
  Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.
  - Klathmon 9y ago
    Oh I absolutely 100% agree, I just wanted to point out that sometimes a lot of these seemingly crazy reasons come from somewhere, and that as developers that might work with product managers like this, it's our job to help teach them. But maximum lengths (that aren't measured in kb) are a monumentally stupid thing, as are most other password "rules" (No, disallowing words in your password is not a good idea...) Provide a minimum length, and check passwords against common password lists, and use a damn good hashing algorithm with a process in place to easily allow upgrading that hash.