3 ms·
Last Summer I had to create an account with HMRC in the UK. The password requirement was a minimum of 8 characters, a maximum of 12 characters, at least one let
by n4r9 9y ago
Last Summer I had to create an account with HMRC in the UK. The password requirement was a minimum of 8 characters, a maximum of 12 characters, at least one letter and number, and no special characters! Quite how they came up with this set of rules has confused me ever since.
- executesorder66 9y agoIt's to make it as easy as possible for people to crack the passwords, because they know exactly which masks, ranges etc. to use for brute-forcing. /s
- Normal_gaussian 9y agoThe lack of special characters is likely due to them having to work with those public accessibility terminals which have no way to enter those characters.
- jackpeterfletch 9y agoand the 12 character limit probably to do with there being a mainframe somewhere
- Aardwolf 9y agoShouldn't they be storing a hash of the password and a salt?
- consp 9y agoI've met several (official or less of it) instances where my default 32 character passwords are not accepted. Usually the limit is 12, 16 or even 10. My guess is it is stored as a string in a database as a fixed length char field or legacy from the time it was stored that way. Surprisingly many webshops have a 16 char limit, suggesting they use the same backend. My bank used to have 12, but now it is at least over 32 combined with some form of 2FA. I've seen one instance where the password was "hashed" client side and the length thus didn't really matter, the implementation was lacking but they made an effort at least.
- oneeyedpigeon 9y ago> My guess is it is stored as a string in a database as a fixed length char field This is exactly why I treat sites that have password length restrictions with extreme caution, preferring to stay away altogether 99% of the time.
- mamcx 9y ago12? My bank use 4. And are numbers.