4 ms·
Indian NPS, equivalent of personal pension account, government operated, website forces you to change password every 90 days. Accepts any length for new passwor
by davchana 6y ago
Indian NPS, equivalent of personal pension account, government operated, website forces you to change password every 90 days. Accepts any length for new password. Silently truncates it & then hash & store. Now, you are locked out because you dont know what was the actual truncated password they stored.
Happened to me two times, changed password, locked out, had to reset. then while logging in, I noticed their requirement of 12 characters, at next reset used 12 characters, & did not get locked out.
- trickstra 6y agoYes, but that would be OK if the login form truncated the password in the same way as the password change form. They'd both arrive at the same hash. Which is what the comment above you said. What you describe probably means the password change form actually did run the hash on the full length, while the login form truncated it.
- davchana 6y agoNo, login form did not truncated, it showed javascript error toast that password is longer than acceptable. The initial signup also checked & showed that toast. But the 90 day reset page did not.
- JanisL 6y agoThis is definitely not OK because it reduces the entropy of the passwords without the user knowing this has happened.
- trickstra 6y agoI never said it's OK, I just explained what's happening. Ah, now I understand why I got those downvotes. What I meant by "OK" was that it would "work". It wouldn't exhibit the behavior my parent comment was describing. Not that it would be secure or good practice.
- JanisL 6y agoAh that makes more sense, thanks for clarifying.