3 ms·
You think that's bad. Virgin Media - a major ISP/Broadband supplier has these restrictions on is e-mail passwords (effectively the key to many kingdoms) Be bet
by Angostura 9y ago
You think that's bad. Virgin Media - a major ISP/Broadband supplier has these restrictions on is e-mail passwords (effectively the key to many kingdoms)
Be between 8 and 10 characters long (with no spaces)
Contain only numbers and letters (no characters like @*? etc).
Start with a letter.
Not contain 3 numbers in a row.
- diggan 9y agoYou think that's bad? Banc Sabadell, a bank in Spain, requires the users of online banking to have a 4 digit number as their password. Although, they also have 2 factor for doing things involving moving money. But still...
- mrweasel 9y ago> Start with a letter. That is a requirement in a ton of places. Try creating an Oracle database user, and have the password start with a number. To be fair it's documented that it won't work, but Oracle won't stop you from doing it, so you end up with an unusable account.
- tempay 9y agoThis shouldn't be an issue. You should always be storing a hash of the password, making the content of the password irrelevant. The hash might start with a number, but then you can just make a versioning scheme for the hash which is identified by the first character being a letter. I don't understand how this is still a common issue.
- bradleyjg 9y agoEvery password hashing library I've worked with has output starting with a $. It's use a deliminator to separate the id, strength, salt, and hash (sometimes the last two are not separated). So for example, a bcrypt output might look like: $2a$12$2zuYZPvIlfC.L84k0oWZR.8yGd62dPkhoyg4aEC6TzGl7aASTw5F.