4 ms·

As a person who spent a long time today changing passwords (in part due to the Gawker thing, but I had been meaning to for a while), I have some very nasty thin

As a person who spent a long time today changing passwords (in part due to the Gawker thing, but I had been meaning to for a while), I have some very nasty things to say about how many sites have stupid restrictions on passwords - why do you care if I want a password that's longer than 8 characters? Why do you care if I want to include a non-alphanum in my password? wtf, really, why? It's easier to not have those restrictions on a field so why why why are you going to extra trouble to add them? Oh I'm getting mad just thinking about it.

brown9-2 16y ago
I was amazed to find one my banks (Chase) limited the password to something like 12 characters when going through this same exercise yesterday.
- harshpotatoes 16y ago
  I know, right? And even more insane, they only allow alpha numerics, no symbols allowed. And for probably the only password which matters...
  - glhaynes 16y ago
    Yes, exactly. I was surprised how little correlation there was between how important the security of the site was and what quality of password was allowed by the site.
    - count 16y ago
      Some of that is archaic database tables (or using NIS/YP as the user manager in the backend). You didn't used to be able to start a password on AMEX's sites with a digit...
      - Sephr 16y ago
        Except that they should be storing the hash anyways.
        count 16y ago
        What part of archaic was clear? rpc.yppaswd isn't gone...
      - drinian 16y ago
        No bank should be storing passwords as plaintext, therefore the content of your password should not be their concern.
        bmastenbrook 16y ago
        I don't think it's just about hashing. When I see restrictions on passwords or other fields, I always assume the worst. If < is not allowed, that's because your password will show up unencoded in HTML somewhere. If $ is not allowed, that's because somebody is afraid that it will actually be treated as a variable reference somewhere. Likewise & or % in URL-encoded data, ' or " in JavaScript, etc. The most universal and silent restriction seems to be on NUL bytes.
        count 16y ago
        Back-ended by non-RDBMS systems, the banks may be using something like YP or NIS to store passwords so that multiple systems can hit one, central authentication system. NIS had horrible password restriction issues (much like LANMAN).
- obsaysditto 16y ago
  To add, American Express puts a cap at 8 characters on their online services.
- jodrellblank 16y ago
  I was amazed to find Paypal has a shorter limit than eBay.
- cdr 16y ago
  The thing I found the worst about Chase is they require a number in your username. Not that the other restrictions aren't inane (6-12 char password, alphanumeric only, etc).
- jpr 16y ago
  My bank password is 4 digits. But they ask another, one shot 4 digit password from a table they've sent to you when you actually move money. I thought all banks did this?
  - lzm 16y ago
    Mine uses an 8-digit password for the website, plus another 6-digit one for transactions. On top of that you have to authorize the computer you use (they send you an SMS with a code if you log in from a new computer). I don't know how they uniquely identify your system, but the technology is Java-based.
da5e 16y ago
Yes, and they wait to tell you their arcane rules until after you've typed in the password that you want. So you have to repeat. It's like that teaching method I saw on Fernwood Tonight that simply shocked the learner for a wrong answer.
rwhitman 16y ago
I discovered that Sallie Mae doesn't accept special characters. And that iTunes now forces one capital letter. I dunno, I think if you've used a special character you should be forgiven for not using a uppercase letter
jodrellblank 16y ago
People who really should know better: The British Computer Society (the UK IT professional organisation). http://i.imgur.com/o5V7d.jpg http://i.imgur.com/o5V7d.jpg
wladimir 16y ago
I can see reasons for requiring non-alphanumeric characters in a password (even though the reasoning behind that might not be valid). But why the hell you would want to forbid using them, is beyond me. Still I've seen this in pretty many sites, even modern ones. Maybe they don't have proper parametrized queries and are afraid of SQL injections :)

brown9-2 16y ago

I was amazed to find one my banks (Chase) limited the password to something like 12 characters when going through this same exercise yesterday.

harshpotatoes 16y ago
I know, right? And even more insane, they only allow alpha numerics, no symbols allowed. And for probably the only password which matters...
- glhaynes 16y ago
  Yes, exactly. I was surprised how little correlation there was between how important the security of the site was and what quality of password was allowed by the site.
  - count 16y ago
    Some of that is archaic database tables (or using NIS/YP as the user manager in the backend). You didn't used to be able to start a password on AMEX's sites with a digit...
    - Sephr 16y ago
      Except that they should be storing the hash anyways.
      - count 16y ago
        What part of archaic was clear? rpc.yppaswd isn't gone...
    - drinian 16y ago
      No bank should be storing passwords as plaintext, therefore the content of your password should not be their concern.
      - bmastenbrook 16y ago
        I don't think it's just about hashing. When I see restrictions on passwords or other fields, I always assume the worst. If < is not allowed, that's because your password will show up unencoded in HTML somewhere. If $ is not allowed, that's because somebody is afraid that it will actually be treated as a variable reference somewhere. Likewise & or % in URL-encoded data, ' or " in JavaScript, etc. The most universal and silent restriction seems to be on NUL bytes.
      - count 16y ago
        Back-ended by non-RDBMS systems, the banks may be using something like YP or NIS to store passwords so that multiple systems can hit one, central authentication system. NIS had horrible password restriction issues (much like LANMAN).
obsaysditto 16y ago
To add, American Express puts a cap at 8 characters on their online services.
jodrellblank 16y ago
I was amazed to find Paypal has a shorter limit than eBay.
cdr 16y ago
The thing I found the worst about Chase is they require a number in your username. Not that the other restrictions aren't inane (6-12 char password, alphanumeric only, etc).
jpr 16y ago
My bank password is 4 digits. But they ask another, one shot 4 digit password from a table they've sent to you when you actually move money. I thought all banks did this?
- lzm 16y ago
  Mine uses an 8-digit password for the website, plus another 6-digit one for transactions. On top of that you have to authorize the computer you use (they send you an SMS with a code if you log in from a new computer). I don't know how they uniquely identify your system, but the technology is Java-based.

da5e 16y ago

Yes, and they wait to tell you their arcane rules until after you've typed in the password that you want. So you have to repeat. It's like that teaching method I saw on Fernwood Tonight that simply shocked the learner for a wrong answer.

rwhitman 16y ago

I discovered that Sallie Mae doesn't accept special characters. And that iTunes now forces one capital letter. I dunno, I think if you've used a special character you should be forgiven for not using a uppercase letter

jodrellblank 16y ago

People who really should know better: The British Computer Society (the UK IT professional organisation). http://i.imgur.com/o5V7d.jpg http://i.imgur.com/o5V7d.jpg

wladimir 16y ago

I can see reasons for requiring non-alphanumeric characters in a password (even though the reasoning behind that might not be valid). But why the hell you would want to forbid using them, is beyond me. Still I've seen this in pretty many sites, even modern ones. Maybe they don't have proper parametrized queries and are afraid of SQL injections :)