9 ms·

Agreed - there's so much I find frustrating about how companies manage passwords in addition to mandatory changing. - Maximum length requirements (often secret

Agreed - there's so much I find frustrating about how companies manage passwords in addition to mandatory changing. - Maximum length requirements (often secret until you try to put a password in) - Requiring some symbols, but not others - Silent truncation of the the password without telling you - Failure because the password is too long, but the error says something else (like missing symbol) This isn't just small unknown companies either. If you use a password longer than 32chars in Zoom when creating your account it just truncates the remaining without telling you. Login works on the websites, but if you try to login via the client it fails. If I manually backspace to 32chars it works. I tried to tell it to their US Twitter support and they just kept sending me a password reset link so I gave up (they're a bad company anyway [0]). Tmobile's website used to do the same thing, except worse because it would truncate on creation but not on validation. How is this not standardized in some sane way? An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol. [0]: https://zalberico.com/essay/2020/06/13/zoom-in-china.html https://zalberico.com/essay/2020/06/13/zoom-in-china.html

mr_smith434 6y ago
My favorite is silent truncation on the signup page but not on the login page. > I paste in my password. It gets cut off to N characters by the form. > I paste that same password on the login page. There is no character limit on the login form.
- fossuser 6y ago
  "Just get them to create an account, they can suffer through our horrible software after."
- OGWhales 6y ago
  Wow... surely that would've blown up in their faces almost immediately.
- livre 6y ago
  The opposite happened to me a few times, signup doesn't truncate, the database accepts it but login truncates on the backend and you can't login.
vladvasiliu 6y ago
> Silent truncation of the the password without telling you Bonus points for truncating the password differently in the login form and the password change form. Now you can't login anymore! > Failure because the password is too long, but the error says something else (like missing symbol) A few years ago the local City government in Paris put out some new app to pay for parking. You'd have to create an account and give them your credit card[0]. When I say they had some ridiculous maximum password length, something like 8 characters, I decided that I could actually take the five minutes to pay in person. I haven't tried the app ever since, so no idea if this crazy limitation is still in effect. --- [0] There was no option to give the credit card on each payment, they had to save it on file. Of course, they weren't aware that local banks were rolling out credit cards with changing verification codes, so some cards would've had to be re-entered anyway...
- BrandoElFollito 5y ago
  Speaking about France, my bank (Boursorama) requires an 8 DIGITS password. And they add the horrible on-screen pad you have to click through (everyone can memorize it). People working in bank regulations are truly incompetent.
- syntheticnature 6y ago
  > Bonus points for truncating the password differently in the login form and the password change form. Now you can't login anymore! Yes, when I setup my first password manager one of my banks said "max length 32" so I updated to a 32-character password. Then, when I next went to login, I found the login form had an off-by-one error and Javascript would truncate the password down to 31 characters. I was lucky and knew just enough to be able to use the console to patch the Javascript on the fly. I complained to them and they said they'd look into it; a month later I went down to a 30-character password, to stay far away from any further off-by-one issues.
  - Enginerrrd 6y ago
    >I went down to a 30-character password, to stay far away from any further off-by-one issues. Heh... Developer: Shoot, we've got an off by one error here. No problem, I'll just add one. Or should I subtract one? *10 min later* OP: That's weird, my 30 character password is now failing.
jackson1442 6y ago
> An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol. For a bank?! And here I am complaining that Chase doesn't support application-based OTP. I hope you ran far far away from that CU.
- fossuser 6y ago
  Yeah, I was in college at the time - banks often seem to have really old and not very good systems. I use Fidelity now and while it has issues, it's much better.
  - tfvlrue 6y ago
    Funny thing about Fidelity -- if you call them to deal with an account issue, the automated phone system asks you to enter your account password using the phone keypad. And it's quite impatient (I wasn't a third of the way through my 32-character password before it gave up and transferred me straight to a representative!)
- millerm 6y ago
  I forgot my password for a credit union back in the day (before I started using a password manager as we all have so many online accounts now). I clicked the "Forgot password?" button... and they sent my original damn password back to me, in email. There are just so many things wrong with that. I complained, actually talked to their "technical people" and explained the awfulness of it, then moved all my money out of that credit union. They did change how it reset later, as another member had told me, but I bet they still stored the plain text password. I was seriously angry with their awful security.
strifey 6y ago
Schwab used to do the "silently truncate to 8 chars" fail, but they _also_ silently changed all chars to upper/lower so the password was case insensitive. Still can't believe they were allowed to have such a bad and secret password policy for so long.
- xmprt 6y ago
  Who in the right mind thought that would be a good idea? It seems like the type of case where some executive though that failed password attempts would increase customer support load by 0.1% and therefore decided to make it a lot easier to log in. But in that case, why did they decide to stop at 8? I feel like they would have made passwords a 4 digit pin if they had their way.
  - bluGill 6y ago
    Probably someone working on a limited mainframeish type computer in 1964 when many terminals didn't support lower case and the memory to store passwords was expensive. The idea of encrypting the password probably didn't exist in those days either. None of this mattered because all the terminals were inside their building so you had to get by the guard to get in. Best practices have moved on many times since then.
    - OGWhales 6y ago
      This was my guess too. Last mainframe I used still used 8 character, non case-sensitive passwords.
  - deleted 6y ago
    [deleted]
  - sjy 6y ago
    > they would have made passwords a 4 digit pin if they had their way There’s a well-known bank in Australia that has been doing this for years [1]. It’s very convenient, and if there was a significant fraud risk associated with it, you’d think they would have changed their policy by now. [1] https://www.ing.com.au/securebanking/ https://www.ing.com.au/securebanking/
isoskeles 6y ago
Maximum length makes sense if the hashing algorithm they're using does not go past that length. I think this puts your 1st and 3rd bullet points at odds in some cases, if I understand your point correctly. I'm not looking this up right now, but I believe bcrypt or some 'version' or 'implementation' (excuse the inaccurate language) of bcrypt limits you to 72 characters. If that limit is not made clear to the user, then they may find it odd when their 73+ character password can have the last N-72 characters changed and still successfully log in. Silent truncation is most likely a result of ignorance on the part of the software developer (I'll admit I did not know about this limit for a long time), whereas maximum length could be the opposite. More info on this, since I'm no expert: https://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length https://security.stackexchange.com/questions/39849/does-bcry...
- fossuser 6y ago
  Thanks - the sites I'm complaining about typically limit characters somewhere between 18-32 so I suspect it's unrelated to this.
- Sammi 6y ago
  You can solve this limitation yourself by implementing a simple client side digest hash before sending to the backend for proper password hashing. So your backend receives the fixed length digest hash and not the actual password for hashing. With a good digest hash algorithm like sha256 you are effectively able to support "infinitely" long passwords without any significant loss of entropy.
  - kccqzy 6y ago
    The problem with this approach is that now someone on the backend will mistakenly think, hey the password is already hashed by the client, let's just store that directly in the database! And now you essentially have passwords stored in plain text.
    - Sammi 6y ago
      If your backend and frontend engineers are that bad at communicating the api then you probably already have a lot of security problems to begin with.
glasss 6y ago
There was a "bug" a few years back in Dell iDRAC that silently truncated the password. Took a number of support calls and ticket escalations to get them to recognize it and patch it. It occurred to me then that if Dell's enterprise team did it that it must be much more rampant than I've seen.
- sofixa 6y ago
  iDRACs aren't supposed to be public, and are on average far less sensitive than a bank account, so all in all, not that bad. And considering the quality of Dell software, it's actually better than most of their useless pieces of crapware.
  - LilBytes 6y ago
    I saw this bug. Security risk or not. Changing your password on the idrac and it not being what's expected and having to jump into a DC to change 30+ host iDRACs was not ideal. All because I couldn't find the bug at the time, I read it a few weeks later only after over a week of back breaking basic sys admin work. Small bonus. It built my use case for fucking off more on premise infrastructure into the cloud.
rPlayer6554 6y ago
> An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol. Woah that's so secure. What if you only had 2 characters; both symbols. I'm sure that is 2x as secure.
- michaelcampbell 6y ago
  > What if you only had 2 characters; both symbols. I'm sure that is 2x as secure. Wouldn't it be 4x? (2^2)
- baobabKoodaa 6y ago
  Yes, it gets more secure as you add more requirements. Let's mandate that last character is a digit larger than 1, but smaller than 3. Also, the password must be exactly 7 characters long, and the first 6 characters must spell out a class in WoW, lowercased.
ajford 6y ago
A shitty local bank back home truncated without telling you as well. Didn't realize it until they rolled out a mobile app and my password didn't work. After complaining about it, a friend who worked at said bank as a teller said to try truncating to 8 chars and it worked. :rage: Apparently it was known internally, as they used some ancient system behind the scenes that would only support a max of 8 chars, and the website just truncated your password and passed that on. The new app didn't truncate and would get an error response.
wave100 6y ago
Ha, funny to see my old bank from college mentioned on here. For what it's worth, their site seems to be a lot more reasonable about passwords nowadays.
quickthrower2 6y ago
Yeah love adding a !1 to the end of a otherwise secure password then incrementing the number every month

mr_smith434 6y ago

My favorite is silent truncation on the signup page but not on the login page. > I paste in my password. It gets cut off to N characters by the form. > I paste that same password on the login page. There is no character limit on the login form.

fossuser 6y ago
"Just get them to create an account, they can suffer through our horrible software after."
OGWhales 6y ago
Wow... surely that would've blown up in their faces almost immediately.
livre 6y ago
The opposite happened to me a few times, signup doesn't truncate, the database accepts it but login truncates on the backend and you can't login.

vladvasiliu 6y ago

> Silent truncation of the the password without telling you Bonus points for truncating the password differently in the login form and the password change form. Now you can't login anymore! > Failure because the password is too long, but the error says something else (like missing symbol) A few years ago the local City government in Paris put out some new app to pay for parking. You'd have to create an account and give them your credit card[0]. When I say they had some ridiculous maximum password length, something like 8 characters, I decided that I could actually take the five minutes to pay in person. I haven't tried the app ever since, so no idea if this crazy limitation is still in effect. --- [0] There was no option to give the credit card on each payment, they had to save it on file. Of course, they weren't aware that local banks were rolling out credit cards with changing verification codes, so some cards would've had to be re-entered anyway...

BrandoElFollito 5y ago
Speaking about France, my bank (Boursorama) requires an 8 DIGITS password. And they add the horrible on-screen pad you have to click through (everyone can memorize it). People working in bank regulations are truly incompetent.
syntheticnature 6y ago
> Bonus points for truncating the password differently in the login form and the password change form. Now you can't login anymore! Yes, when I setup my first password manager one of my banks said "max length 32" so I updated to a 32-character password. Then, when I next went to login, I found the login form had an off-by-one error and Javascript would truncate the password down to 31 characters. I was lucky and knew just enough to be able to use the console to patch the Javascript on the fly. I complained to them and they said they'd look into it; a month later I went down to a 30-character password, to stay far away from any further off-by-one issues.
- Enginerrrd 6y ago
  >I went down to a 30-character password, to stay far away from any further off-by-one issues. Heh... Developer: Shoot, we've got an off by one error here. No problem, I'll just add one. Or should I subtract one? *10 min later* OP: That's weird, my 30 character password is now failing.

jackson1442 6y ago

> An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol. For a bank?! And here I am complaining that Chase doesn't support application-based OTP. I hope you ran far far away from that CU.

fossuser 6y ago
Yeah, I was in college at the time - banks often seem to have really old and not very good systems. I use Fidelity now and while it has issues, it's much better.
- tfvlrue 6y ago
  Funny thing about Fidelity -- if you call them to deal with an account issue, the automated phone system asks you to enter your account password using the phone keypad. And it's quite impatient (I wasn't a third of the way through my 32-character password before it gave up and transferred me straight to a representative!)
millerm 6y ago
I forgot my password for a credit union back in the day (before I started using a password manager as we all have so many online accounts now). I clicked the "Forgot password?" button... and they sent my original damn password back to me, in email. There are just so many things wrong with that. I complained, actually talked to their "technical people" and explained the awfulness of it, then moved all my money out of that credit union. They did change how it reset later, as another member had told me, but I bet they still stored the plain text password. I was seriously angry with their awful security.

strifey 6y ago

Schwab used to do the "silently truncate to 8 chars" fail, but they _also_ silently changed all chars to upper/lower so the password was case insensitive. Still can't believe they were allowed to have such a bad and secret password policy for so long.

xmprt 6y ago
Who in the right mind thought that would be a good idea? It seems like the type of case where some executive though that failed password attempts would increase customer support load by 0.1% and therefore decided to make it a lot easier to log in. But in that case, why did they decide to stop at 8? I feel like they would have made passwords a 4 digit pin if they had their way.
- bluGill 6y ago
  Probably someone working on a limited mainframeish type computer in 1964 when many terminals didn't support lower case and the memory to store passwords was expensive. The idea of encrypting the password probably didn't exist in those days either. None of this mattered because all the terminals were inside their building so you had to get by the guard to get in. Best practices have moved on many times since then.
  - OGWhales 6y ago
    This was my guess too. Last mainframe I used still used 8 character, non case-sensitive passwords.
- deleted 6y ago
  [deleted]
- sjy 6y ago
  > they would have made passwords a 4 digit pin if they had their way There’s a well-known bank in Australia that has been doing this for years [1]. It’s very convenient, and if there was a significant fraud risk associated with it, you’d think they would have changed their policy by now. [1] https://www.ing.com.au/securebanking/ https://www.ing.com.au/securebanking/

isoskeles 6y ago

Maximum length makes sense if the hashing algorithm they're using does not go past that length. I think this puts your 1st and 3rd bullet points at odds in some cases, if I understand your point correctly. I'm not looking this up right now, but I believe bcrypt or some 'version' or 'implementation' (excuse the inaccurate language) of bcrypt limits you to 72 characters. If that limit is not made clear to the user, then they may find it odd when their 73+ character password can have the last N-72 characters changed and still successfully log in. Silent truncation is most likely a result of ignorance on the part of the software developer (I'll admit I did not know about this limit for a long time), whereas maximum length could be the opposite. More info on this, since I'm no expert: https://security.stackexchange.com/questions/39849/does-bcrypt-have-a-maximum-password-length https://security.stackexchange.com/questions/39849/does-bcry...

fossuser 6y ago
Thanks - the sites I'm complaining about typically limit characters somewhere between 18-32 so I suspect it's unrelated to this.
Sammi 6y ago
You can solve this limitation yourself by implementing a simple client side digest hash before sending to the backend for proper password hashing. So your backend receives the fixed length digest hash and not the actual password for hashing. With a good digest hash algorithm like sha256 you are effectively able to support "infinitely" long passwords without any significant loss of entropy.
- kccqzy 6y ago
  The problem with this approach is that now someone on the backend will mistakenly think, hey the password is already hashed by the client, let's just store that directly in the database! And now you essentially have passwords stored in plain text.
  - Sammi 6y ago
    If your backend and frontend engineers are that bad at communicating the api then you probably already have a lot of security problems to begin with.

glasss 6y ago

There was a "bug" a few years back in Dell iDRAC that silently truncated the password. Took a number of support calls and ticket escalations to get them to recognize it and patch it. It occurred to me then that if Dell's enterprise team did it that it must be much more rampant than I've seen.

sofixa 6y ago
iDRACs aren't supposed to be public, and are on average far less sensitive than a bank account, so all in all, not that bad. And considering the quality of Dell software, it's actually better than most of their useless pieces of crapware.
- LilBytes 6y ago
  I saw this bug. Security risk or not. Changing your password on the idrac and it not being what's expected and having to jump into a DC to change 30+ host iDRACs was not ideal. All because I couldn't find the bug at the time, I read it a few weeks later only after over a week of back breaking basic sys admin work. Small bonus. It built my use case for fucking off more on premise infrastructure into the cloud.

rPlayer6554 6y ago

> An old credit union I was part of in NY (SEFCU) mandated passwords with exactly 6 characters. When I complained about this I was told it was secure because they forced one of the characters to be a symbol. Woah that's so secure. What if you only had 2 characters; both symbols. I'm sure that is 2x as secure.

michaelcampbell 6y ago
> What if you only had 2 characters; both symbols. I'm sure that is 2x as secure. Wouldn't it be 4x? (2^2)
baobabKoodaa 6y ago
Yes, it gets more secure as you add more requirements. Let's mandate that last character is a digit larger than 1, but smaller than 3. Also, the password must be exactly 7 characters long, and the first 6 characters must spell out a class in WoW, lowercased.

ajford 6y ago

A shitty local bank back home truncated without telling you as well. Didn't realize it until they rolled out a mobile app and my password didn't work. After complaining about it, a friend who worked at said bank as a teller said to try truncating to 8 chars and it worked. :rage: Apparently it was known internally, as they used some ancient system behind the scenes that would only support a max of 8 chars, and the website just truncated your password and passed that on. The new app didn't truncate and would get an error response.

wave100 6y ago

Ha, funny to see my old bank from college mentioned on here. For what it's worth, their site seems to be a lot more reasonable about passwords nowadays.

quickthrower2 6y ago

Yeah love adding a !1 to the end of a otherwise secure password then incrementing the number every month