6 ms·

What if it was just because of the F word? AT&T does the same thing. https://gizmodo.com/why-at-t-wont-let-you-swear-in-your-passwords-5993436 https://gizmodo

What if it was just because of the F word? AT&T does the same thing. https://gizmodo.com/why-at-t-wont-let-you-swear-in-your-passwords-5993436 https://gizmodo.com/why-at-t-wont-let-you-swear-in-your-pass...

miohtama 6y ago
Why would a company care what you have as a password in the first place?
- tupac_speedrap 6y ago
  Probably some overeager dev or maybe somebody higher up not understanding that you should never see a plain text password if you are doing it right.
- GoblinSlayer 6y ago
  That's basics of SaaSS.
- jhauris 6y ago
  In this case it seems like a form of thought control. Even if no one else knows your unpatriotic password you can't use it because you shouldn't be thinking those thoughts.
- twic 6y ago
  They don't. They care about keeping people opposed to the government off their app.
yardie 6y ago
Why would it matter. The password shouldn't be visible to them. If they were doing it right the word "fuck" would be an illegible pile of SHA1 hashes. This only proves they aren't encrypting passwords on the fly. And have, and do, the ability to read your password. Honestly, I don't know why anyone uses WeChat. In China it's a requirement but for any other reason give it a hard pass.
- mc32 6y ago
  Maybe they just have simple hashes (unsalted) of their disallowed passwords and flag hits to them. They compute all the password combos that trash the CCP (and whatever else) and autoban, I guess...
  - MCOfficer 6y ago
    I doubt people were using "Fuck", rather something like "FuckMyEx" or whatever, which has a completely different hash. Also, passwords should be hashed with salt.
    - mc32 6y ago
      “Should“ but do they?
  - shakna 6y ago
    In which case they aren't even salting the password, which means that hashing the password isn't doing a whole heap. It isn't plaintext, but it isn't that far from it.
- mytailorisrich 6y ago
  Fully agree that a password should not be manipulated beyond what is absolutely necessary and this is usually just hashing it and getting rid of the cleartext asap. However, it is difficult to draw any conclusions from a tweet. The author is a journalist covering China so she might already had performed various 'tests' on her WeChat account that raised various red flags for various reasons until her account ended up being flagged for deletion. If they are really checking cleartext passwords against 'offensive' keywords they are impressively thorough, tbh, but it would still seem odd to delete an account just like that instead of rejecting the password so I'm thinking that there is more to her story, if it is true.
  - RandomWorker 6y ago
    I’ve been thinking that it could be a great safety feature. If every site had its own mapping then uses a hash it would eliminate simple password matching. If they get access to the database, you could find the password by taking common paswords hash them and do a match. This would not be impossible with the speed of databases. If every site did that it could prevent this line of attack. I can’t really see a bad thing about.
deleted 6y ago
[deleted]
SilasX 6y ago
AT&T prohibits bad words, but it's not "the same thing" as in the story. In the story, they gave him no warning that the password was prohibited, or why, and then permanently deleted the account with no recourse. That's pretty different from "oh we don't allow that, pick another one", even if the latter is also annoying.
- empath75 6y ago
  AT&T prohibits commonly used passwords, which includes a lot of curse words.
- gitrog 6y ago
  > In the story, they gave him no warning that the password was prohibited, or why, and then permanently deleted the account with no recourse. /She/ is also a well known journalist who could easily have had her account being monitored. Other people on that thread claimed that they changed their password to the same and nothing happened.

miohtama 6y ago

Why would a company care what you have as a password in the first place?

tupac_speedrap 6y ago
Probably some overeager dev or maybe somebody higher up not understanding that you should never see a plain text password if you are doing it right.
GoblinSlayer 6y ago
That's basics of SaaSS.
jhauris 6y ago
In this case it seems like a form of thought control. Even if no one else knows your unpatriotic password you can't use it because you shouldn't be thinking those thoughts.
twic 6y ago
They don't. They care about keeping people opposed to the government off their app.

yardie 6y ago

Why would it matter. The password shouldn't be visible to them. If they were doing it right the word "fuck" would be an illegible pile of SHA1 hashes. This only proves they aren't encrypting passwords on the fly. And have, and do, the ability to read your password. Honestly, I don't know why anyone uses WeChat. In China it's a requirement but for any other reason give it a hard pass.

mc32 6y ago
Maybe they just have simple hashes (unsalted) of their disallowed passwords and flag hits to them. They compute all the password combos that trash the CCP (and whatever else) and autoban, I guess...
- MCOfficer 6y ago
  I doubt people were using "Fuck", rather something like "FuckMyEx" or whatever, which has a completely different hash. Also, passwords should be hashed with salt.
  - mc32 6y ago
    “Should“ but do they?
- shakna 6y ago
  In which case they aren't even salting the password, which means that hashing the password isn't doing a whole heap. It isn't plaintext, but it isn't that far from it.
mytailorisrich 6y ago
Fully agree that a password should not be manipulated beyond what is absolutely necessary and this is usually just hashing it and getting rid of the cleartext asap. However, it is difficult to draw any conclusions from a tweet. The author is a journalist covering China so she might already had performed various 'tests' on her WeChat account that raised various red flags for various reasons until her account ended up being flagged for deletion. If they are really checking cleartext passwords against 'offensive' keywords they are impressively thorough, tbh, but it would still seem odd to delete an account just like that instead of rejecting the password so I'm thinking that there is more to her story, if it is true.
- RandomWorker 6y ago
  I’ve been thinking that it could be a great safety feature. If every site had its own mapping then uses a hash it would eliminate simple password matching. If they get access to the database, you could find the password by taking common paswords hash them and do a match. This would not be impossible with the speed of databases. If every site did that it could prevent this line of attack. I can’t really see a bad thing about.

deleted 6y ago

[deleted]

SilasX 6y ago

AT&T prohibits bad words, but it's not "the same thing" as in the story. In the story, they gave him no warning that the password was prohibited, or why, and then permanently deleted the account with no recourse. That's pretty different from "oh we don't allow that, pick another one", even if the latter is also annoying.

empath75 6y ago
AT&T prohibits commonly used passwords, which includes a lot of curse words.
gitrog 6y ago
> In the story, they gave him no warning that the password was prohibited, or why, and then permanently deleted the account with no recourse. /She/ is also a well known journalist who could easily have had her account being monitored. Other people on that thread claimed that they changed their password to the same and nothing happened.