20 ms·

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which t

A colleague used an app's "generate secure password" feature to change their ISP's web portal login - which then also became the WAN router's password - which they didn't realise. It was about a week before the router dropped its connection and needed to re-authenticate - and that's when I was called in to investigate the loss of connectivity - which Windows 10 very unhelpfully reported as the network cable disconnected and was resetting or power-saving on the NIC so the "link active" LED on the switch was going out for about 2 secs every 10 sec. Cue a round of cable and switch swapping to no benefit. The LEDs for all other devices on the switch (running Linux and mostly internal servers) were behaving normally. I finally backtraced to the router and a useful error message. We put two-and-two together and my colleague called up the auto-saved details in their password manager; it was long, and ALL non-alpha numeric characters - starting with a backtick, which the router would not accept. I tethered my phone to my laptop and tried to login to the Web account portal - which would NOT accept the passphrase. I tried it without the backtick "just in case" - nope. We had to do a "lost password" reset on the portal..and wait for the email with link. Lessons learned: The ISP's password change page did not seem to validate input, but the login page did. Avoid backticks in passwords.

stevekemp 7y ago
So many home-routers are run with horrid CGI-scripts on the back-end - I'd not be amazed to learn that submitting a form-field with `blah` in it would try to run the command blah (probably via busybox). If you have time/patience it might be worth exploring.
- hultner 7y ago
  I've actually rooted an Asus router owned by a relative, this was about 5 years back so it's hopefully fixed now. Noticed some strange behavior after a mistype and tried something like `whoami` (not exactly) and got root back so tried a reverse she'll with NC which worked perfectly. Googled it afterwards and found a ton of similar flaws on other home routers. Tried to do some kind of responsible disclosure but never got a reply or saw a fix then I forgot about it.
kccqzy 7y ago
I had a backtick in one of my passwords very long ago. When I first got my iPhone I couldn't figure out how to type that backtick until I realized one needs to press and hold and apostrophe.
BWStearns 7y ago
I had something similar happen with (iirc) spectrum of the power company a couple years ago. Their customer portal let me use a complicated password to sign up, it sent me the confirmation email prompting me to log in, and refused my password for forbidden characters. But then I couldn’t reset my password because I hadn’t verified, and I couldn’t modify the account cause I couldn’t log in. I was just trapped in limbo. Customer service said they couldn’t fix it for me. I had to pay my bill by phone until I moved.
gruez 7y ago
>Avoid backticks in passwords. Is there even a reason to include special characters in passwords? They add 10% more security[1] but cause all sorts of issues with systems. Just use an alphanumeric password that's 10% longer, and if special characters are mandatory, use a safe character at the end like _ or -. [1] 6.55 bits per character (all printable ascii characters) rather than 5.95 (only alphanumeric)
- mehrdadn 7y ago
  > 10% more security (6.55 vs. 5.95 bits per character) That's not how this works. By your logic having a password consisting of 1,2,3,4 is only twice as secure as having just 1,2.
  - monocasa 7y ago
    That's absolutely how bits of entropy work.
    - robocat 7y ago
      However symbol frequency is also significant for entropy. Do you think 1 in 25 four letter passwords contain a backtick? If you were brute forcing an ASCII password (no whitespace), would you naively cycle from ! up to ~ for each character?
      - monocasa 7y ago
        The context is randomly generated passwords, so dictionary attacks (or other attacks that look at the plaintext from a Huffman encoding perspective) aren't really relevant.
    - mehrdadn 7y ago
      That's most definitely not how security works. The strength of your password is not proportional to the number of bits of entropy it has.
dvdkon 7y ago
Once upon a time, I went through my logins and tried to change them to strings with weird characters. I ended up with a password of on an internal school site and couldn't change it to anything else, since the "change password" site somehow rejected it.
Ambroos 7y ago
Similarly, my Belgian ISP (Telenet) has WiFi home gateways that are configured by their web portal, and config is pushed by the ISP. I figured out that they only did validation on SSIDs client-side, so managed to get around that to put emoji's in my SSID. Which then proceeded to soft-brick the entire thing on config push. I'd have to log in to the web portal via another connection, change the SSID there, and then reset the hardware with the reset button to get internet working again.
- zifnab06 7y ago
  The stereo in my 2013 GTI crashed hilariously if you tried to pair a Bluetooth device with anything in the name outisde of [a-zA-Z0-9]. I wish I'd have messed around with it some more before I sold it (it was a silly car to own for how little I drive)
cgriswald 7y ago
Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.
- dajonker 7y ago
  Yes, this is terribly annoying, often there is a minimum length but no mention of maximum length. I see this on many, many websites...
  - luc4sdreyer 7y ago
    What kind of range limits are you talking about? 30? 100?
    - dgellow 7y ago
      I believe that Blizzard had a limit of ~20 until recently for battle.net accounts (don't know if that's still the case).
      - Tecuane 7y ago
        Passwords for Blizzard accounts are also case-insensitive, as they are converted to upper case before hashing. Try it! I first found this while working on a WoW server emulator in around 2009, but I believe it's been the case since Battle.net 1.0 was launched in 1996. In order to preserve backwards compatibility, it's never been changed.
    - jtc331 7y ago
      Wells Fargo’s is 12 IIRC.
      - marktangotango 7y ago
        Lots and lots of legacy systems do this, very low limit, case insensitive, numbers and letters only. I know of a major retailer with 10 character, case insensitive, alpha numeric for All their systems. Why? Because that’s the lowest common denominator (as400).
alibarber 7y ago
Oooh this reminds me, I am trying to learn a language that of course has ‘non-standard’ characters, and not even anything particularly exciting - Ä, Ö and the like. I thought it’d be cool to help memorise words (and be super secure) by changing frequently used passwords to phrases that contained these words... ...Caused me some trouble.
looperhacks 7y ago
Ah yes, this reminds me of my University account. I chose a long password generated with my password manager, which of course contained a chara66 that was both allowed at set up and usage. But because I had to frequently type it in without my password manager (i.e. on a University PC), I wanted to change it. But the change dialog asked for the old password and didn't accept it, due to the forbidden character. I had to go to the support who refused to believe my story and wasn't able to change my password. It took a few weeks to get hold of a person who was allowed to change passwords.
davchana 7y ago
The Indian version of personal retirement fund NPA website does this, I learnt a lesson. Every certain weeks you Have to change password. No big deal. I will just add an incremental number. Ok, password now is PasswordPass1. Lets login, Wrong password? Why? Error Password length exceeded. So, the password change page will accept any length password, will silently truncate it if longer & save it. Now on login page you have to guess the password length or reset.
amingilani 7y ago
Oh yeah, I've run into a lot of similar problems with even very well tested applications. The password reset field would accept inputs not valid at login time. I mostly ran into this when generating random passwords 100 characters in length from LastPass. At one point GitHub even changed reduced their max password input to a sane amount, and I couldn't log in anymore with my existing insane password length a few years ago. In most cases they fix the case when I report it, but my bank is terrible.
sings 7y ago
I once had the bright idea to use a backslash as a one character password for my girlfriends computer, thinking it would provide amazing convenience – a single character, just above the enter key. Turns out this doesn't work very well, even on a Mac, which you would think would have gone through fairly robust testing.
13of40 7y ago
> avoid backticks in passwords I learned that lesson a different way: When I had a Windows phone my email password had a backtick, and the only way to enter it on the phone was to long-press the apostrophe, pick backtick from the three or four apostrophe variants that appeared, and pray I didn't fat-finger it and enter the wrong character. In general, there are just some second class citizen characters you should always avoid, because you never know how hard they're going to be to enter when you're on a phone or a kiosk or whatever. (Tilde, I'm looking at you, too.)
- myfonj 7y ago
  There are regional keyboard layouts lacking backtick completely. (I would have to use alt+96 or switch keyboard from my default (and only) Czech QWERTZ layout to type `, if I hadn't more convenient AutoHotkey shortcut in effect.)
deleted 7y ago
[deleted]
skgoa 7y ago
I had a similar issue when my bank introduced a new banking app. The web login page has different requirements for the password than the app. I.e. on either I can set my password to something that the other will not accept.
lysp 7y ago
I went to change my password on a forum site that I had not used in a few years. My old password was really weak - think "abc123" or something similar. I logged in and then attempted to change my password to my new standard of 20+ character upper/lower/symbol. The problem was, they'd upgraded their forum software, and there was a bug that added password strength validation to the "old" password field. So I was putting in: Old: abc123 New: sZp10VzIoZI9g143 And was getting the error message "error: your password must be 8+ characters long". After about 10 minutes of frustration and realising they had both client and server validation I went down a similar route as you and used forgot-password even though I knew the password.
BrandoElFollito 7y ago
This is one reason why I stick to alphabet (+case) in my passwords, when I can make them long. I had the exact same issues with some passwords which were accepted when creating them, then not accepted anymore when used to log in. This plus emails such as a@example.com or hjghgfggv@example.someweirdtld show how much sites are broken because of some philosophical ideas of developers.

stevekemp 7y ago

So many home-routers are run with horrid CGI-scripts on the back-end - I'd not be amazed to learn that submitting a form-field with `blah` in it would try to run the command blah (probably via busybox). If you have time/patience it might be worth exploring.

hultner 7y ago
I've actually rooted an Asus router owned by a relative, this was about 5 years back so it's hopefully fixed now. Noticed some strange behavior after a mistype and tried something like `whoami` (not exactly) and got root back so tried a reverse she'll with NC which worked perfectly. Googled it afterwards and found a ton of similar flaws on other home routers. Tried to do some kind of responsible disclosure but never got a reply or saw a fix then I forgot about it.

kccqzy 7y ago

I had a backtick in one of my passwords very long ago. When I first got my iPhone I couldn't figure out how to type that backtick until I realized one needs to press and hold and apostrophe.

BWStearns 7y ago

I had something similar happen with (iirc) spectrum of the power company a couple years ago. Their customer portal let me use a complicated password to sign up, it sent me the confirmation email prompting me to log in, and refused my password for forbidden characters. But then I couldn’t reset my password because I hadn’t verified, and I couldn’t modify the account cause I couldn’t log in. I was just trapped in limbo. Customer service said they couldn’t fix it for me. I had to pay my bill by phone until I moved.

gruez 7y ago

>Avoid backticks in passwords. Is there even a reason to include special characters in passwords? They add 10% more security[1] but cause all sorts of issues with systems. Just use an alphanumeric password that's 10% longer, and if special characters are mandatory, use a safe character at the end like _ or -. [1] 6.55 bits per character (all printable ascii characters) rather than 5.95 (only alphanumeric)

mehrdadn 7y ago
> 10% more security (6.55 vs. 5.95 bits per character) That's not how this works. By your logic having a password consisting of 1,2,3,4 is only twice as secure as having just 1,2.
- monocasa 7y ago
  That's absolutely how bits of entropy work.
  - robocat 7y ago
    However symbol frequency is also significant for entropy. Do you think 1 in 25 four letter passwords contain a backtick? If you were brute forcing an ASCII password (no whitespace), would you naively cycle from ! up to ~ for each character?
    - monocasa 7y ago
      The context is randomly generated passwords, so dictionary attacks (or other attacks that look at the plaintext from a Huffman encoding perspective) aren't really relevant.
  - mehrdadn 7y ago
    That's most definitely not how security works. The strength of your password is not proportional to the number of bits of entropy it has.

dvdkon 7y ago

Once upon a time, I went through my logins and tried to change them to strings with weird characters. I ended up with a password of on an internal school site and couldn't change it to anything else, since the "change password" site somehow rejected it.

Ambroos 7y ago

Similarly, my Belgian ISP (Telenet) has WiFi home gateways that are configured by their web portal, and config is pushed by the ISP. I figured out that they only did validation on SSIDs client-side, so managed to get around that to put emoji's in my SSID. Which then proceeded to soft-brick the entire thing on config push. I'd have to log in to the web portal via another connection, change the SSID there, and then reset the hardware with the reset button to get internet working again.

zifnab06 7y ago
The stereo in my 2013 GTI crashed hilariously if you tried to pair a Bluetooth device with anything in the name outisde of [a-zA-Z0-9]. I wish I'd have messed around with it some more before I sold it (it was a silly car to own for how little I drive)

cgriswald 7y ago

Many, many websites will happily accept passwords of $X characters and then hash only $(X-Y) characters on registration, but try to hash all $X characters on login, so of course the hashes don’t match. And at no point do they tell you the maximum number of characters.

dajonker 7y ago
Yes, this is terribly annoying, often there is a minimum length but no mention of maximum length. I see this on many, many websites...
- luc4sdreyer 7y ago
  What kind of range limits are you talking about? 30? 100?
  - dgellow 7y ago
    I believe that Blizzard had a limit of ~20 until recently for battle.net accounts (don't know if that's still the case).
    - Tecuane 7y ago
      Passwords for Blizzard accounts are also case-insensitive, as they are converted to upper case before hashing. Try it! I first found this while working on a WoW server emulator in around 2009, but I believe it's been the case since Battle.net 1.0 was launched in 1996. In order to preserve backwards compatibility, it's never been changed.
  - jtc331 7y ago
    Wells Fargo’s is 12 IIRC.
    - marktangotango 7y ago
      Lots and lots of legacy systems do this, very low limit, case insensitive, numbers and letters only. I know of a major retailer with 10 character, case insensitive, alpha numeric for All their systems. Why? Because that’s the lowest common denominator (as400).

alibarber 7y ago

Oooh this reminds me, I am trying to learn a language that of course has ‘non-standard’ characters, and not even anything particularly exciting - Ä, Ö and the like. I thought it’d be cool to help memorise words (and be super secure) by changing frequently used passwords to phrases that contained these words... ...Caused me some trouble.

looperhacks 7y ago

Ah yes, this reminds me of my University account. I chose a long password generated with my password manager, which of course contained a chara66 that was both allowed at set up and usage. But because I had to frequently type it in without my password manager (i.e. on a University PC), I wanted to change it. But the change dialog asked for the old password and didn't accept it, due to the forbidden character. I had to go to the support who refused to believe my story and wasn't able to change my password. It took a few weeks to get hold of a person who was allowed to change passwords.

davchana 7y ago

The Indian version of personal retirement fund NPA website does this, I learnt a lesson. Every certain weeks you Have to change password. No big deal. I will just add an incremental number. Ok, password now is PasswordPass1. Lets login, Wrong password? Why? Error Password length exceeded. So, the password change page will accept any length password, will silently truncate it if longer & save it. Now on login page you have to guess the password length or reset.

amingilani 7y ago

Oh yeah, I've run into a lot of similar problems with even very well tested applications. The password reset field would accept inputs not valid at login time. I mostly ran into this when generating random passwords 100 characters in length from LastPass. At one point GitHub even changed reduced their max password input to a sane amount, and I couldn't log in anymore with my existing insane password length a few years ago. In most cases they fix the case when I report it, but my bank is terrible.

sings 7y ago

I once had the bright idea to use a backslash as a one character password for my girlfriends computer, thinking it would provide amazing convenience – a single character, just above the enter key. Turns out this doesn't work very well, even on a Mac, which you would think would have gone through fairly robust testing.

13of40 7y ago

> avoid backticks in passwords I learned that lesson a different way: When I had a Windows phone my email password had a backtick, and the only way to enter it on the phone was to long-press the apostrophe, pick backtick from the three or four apostrophe variants that appeared, and pray I didn't fat-finger it and enter the wrong character. In general, there are just some second class citizen characters you should always avoid, because you never know how hard they're going to be to enter when you're on a phone or a kiosk or whatever. (Tilde, I'm looking at you, too.)

myfonj 7y ago
There are regional keyboard layouts lacking backtick completely. (I would have to use alt+96 or switch keyboard from my default (and only) Czech QWERTZ layout to type `, if I hadn't more convenient AutoHotkey shortcut in effect.)

deleted 7y ago

[deleted]

skgoa 7y ago

I had a similar issue when my bank introduced a new banking app. The web login page has different requirements for the password than the app. I.e. on either I can set my password to something that the other will not accept.

lysp 7y ago

I went to change my password on a forum site that I had not used in a few years. My old password was really weak - think "abc123" or something similar. I logged in and then attempted to change my password to my new standard of 20+ character upper/lower/symbol. The problem was, they'd upgraded their forum software, and there was a bug that added password strength validation to the "old" password field. So I was putting in: Old: abc123 New: sZp10VzIoZI9g143 And was getting the error message "error: your password must be 8+ characters long". After about 10 minutes of frustration and realising they had both client and server validation I went down a similar route as you and used forgot-password even though I knew the password.

BrandoElFollito 7y ago

This is one reason why I stick to alphabet (+case) in my passwords, when I can make them long. I had the exact same issues with some passwords which were accepted when creating them, then not accepted anymore when used to log in. This plus emails such as a@example.com or hjghgfggv@example.someweirdtld show how much sites are broken because of some philosophical ideas of developers.