10 ms·
I just logged in to change my easyJet password: > Your password must be a single word between 6 and 20 characters in length and must not include the special ch
by leejo 6y ago
I just logged in to change my easyJet password:
> Your password must be a single word between 6 and 20 characters in length and must not include the special characters # & + or space.
Come on! This is ridiculous. If you're going to get hacked at least have a sane password policy.
- capableweb 6y agoStill better than my bank (one of Spain's biggest) that requires your password to be 8 (not less, not more) digits.
- gerdesj 6y agoUse "password" - eight letters and it's English and so should be safe on a Spanish site.
- capableweb 6y agoYou missed that we're only allowed to use digits/numbers. No letters!
- coremoff 6y ago72779673
- marsRoverDev 6y agoHSBC in France have the same, it's a huge motivator for me to switch away.
- jesterson 6y agoMay I know why? It's a problem if there is no 2FA but I doubt HSBC won't have 2FA and this password requirements.
- capableweb 6y agoThe bank I'm using has 2FA for all actions performed in the website, so that's my guess as to why they don't prioritize fixing the lame password requirement.
- jesterson 6y agoExactly. 2FA is much more important than complicated password (not that I'm advocating to have a guessable one here), altogether providing acceptable level of security.
- hannasanarion 6y agoHow much you wanna bet they weren't salting passwords in the backend?
- leejo 6y agoPossible, maybe not even hashed? Given the disallowed chars that's suggestive that the form used to be implemented as a GET, so it's possible passwords were in log files for a long time.
- x86_64Ubuntu 6y agoIs there a technical reason to use a GET for authentication? I've always seen it as a POST. If you use GET, won't your parameters be plainly visible in well, everything, unless they put them in the body and that's a whole nother can of worms.
- leejo 6y agoI have definitely seen some sites using GET for authentication, they tend to be ones that have been around for a long time and haven't been fixed. Can't remember the last time I saw this though. I'm not sure when easyJet first started using online accounts, but "you can't use some URI query reserved chars" does seem like a strong indicator there used to be a GET involved.
- ShinTakuya 6y agoNo, https encrypts the URL as well (although the domain itself can be leaked via DNS). But in most respects query params are no different to the body security wise. The main difference is that if you bookmark it, you may end up storing your sensitive data in your bookmarks.
- zwp 6y agoQuery params often end in stuff like web server (WAF, load-balancer, reverse proxy, ...) access logs and they might get accidentally exposed. They shouldn't get exposed of course, but they do. [EDIT: redacted an example of some random dude's access log] If you search for "password" in there you will likely see a new Mirai bot variant [1] bouncing credentials off the server looking for weblogin.cgi on vulnerable Zyxel devices. I imagine PA highlit this detail in their post ("weblogin.cgi accepts both HTTP GET and POST") exactly to ensure sure defenders don't restrict themselves to blocking or investigating only the more normal POST mechanism. [1] https://unit42.paloaltonetworks.com/new-mirai-variant-mukashi/ https://unit42.paloaltonetworks.com/new-mirai-variant-mukash...
- Sosh101 6y agoDoesn't a max length suggest that they are storing passwords rather than hashes?
- PUSH_AX 6y agoSure could be, but to play devils advocate maybe not, some hashing libraries have limits (silent truncation or otherwise) and/or it could be reasonable not to allow users to make the backend hash strings of unbounded length. These specific limitations indicate that it's more likely to be something bad however, it's funny because I remember adding EasyJet to https://github.com/dumb-password-rules/dumb-password-rules/pull/155/files https://github.com/dumb-password-rules/dumb-password-rules/p... last year.
- borplk 6y agoIt doesn't necessarily mean that. A limit always exists. If you don't enforce it yourself you will find out when someone decides to send you 64GB of data to hash as their password. So always better enforce the limit yourself.
- thephyber 6y agoNot guaranteed, but it suggests that their company processes aren't Password Manager friendly.
- doublerabbit 6y ago> must not include the special characters # & + or space. This annoys me the most, my password contains some of those characters. Why is this even a restriction or is just poorly developed code?