5 ms·

The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just

The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible. Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.

Derbasti 15y ago
Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}
- codyrobbins 15y ago
  Yes, I was just going to mention banks as well. I have dealt with multiple online banking systems for major banks that enforced ridiculously low maximum password lengths and alphanumeric-only restrictions. It's one thing for Electronic Arts to have not thought through this stuff, but another entirely when you're talking about a banking system.
- David 15y ago
  My bank limits you to 20 characters, which I'll grant is decent. But: NO non-alphanumerics, and, get this, is case insensitive. This may just convince me to switch banks...
  - irons 15y ago
    American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.
  - city41 15y ago
    My bank is about to roll out a new online banking system. They are requiring us to create a new password for the new system. So in order to log into the new system for the first time, they emailed us telling us to email them back a 6 digit pin to identify ourselves for the first login. My response is to start looking for a new bank.
- HoLyVieR 15y ago
  Enforcing PIN style password for bank is not that bad, as long as they use other factor to identify you.
- andrewflnr 15y ago
  My school only gives you a four-digit numeric PIN, and it defaults to your birth date.
fossuser 15y ago
One site I used (I think it was T-Mobile) simply removed characters from your password without even telling you. That took me a while to figure out.
techdmn 15y ago
I have an issue with att where a complex generated password was accepted as a new password, is rejected on the initial log-in page, then accepted on a subsequent "bad username / password" page. Fun and games.
windsurfer 15y ago
The rules for my university are: * 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed
- alanh 15y ago
  Does your university have a mathematics department? … sigh
- jackvalentine 15y ago
  Mine are: "The new password is to be chosen as a combination of alphabetics, digits and special characters. It must be eight characters long and contain one of the special printable characters (eg $ - ! : / = _). Normal alphabetic characters are case sensitive ie "a" is not the same as "A". Special characters may not appear at the beginning or end."
  - drdaeman 15y ago
    > It must be While it's almost the exact opposite of [0-9]{4,6}, it's extremely annoying too. This is fairly secure for usual website password, but the requirements would throw this away: $ openssl rand -base64 9 TjB3tbYOo1wz Okay, it's fine when you generate a random password for each site (then store it somewhere), but if you're generating password from some one-side function from a site URI, then you have a problem.

Derbasti 15y ago

Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}

codyrobbins 15y ago
Yes, I was just going to mention banks as well. I have dealt with multiple online banking systems for major banks that enforced ridiculously low maximum password lengths and alphanumeric-only restrictions. It's one thing for Electronic Arts to have not thought through this stuff, but another entirely when you're talking about a banking system.
David 15y ago
My bank limits you to 20 characters, which I'll grant is decent. But: NO non-alphanumerics, and, get this, is case insensitive. This may just convince me to switch banks...
- irons 15y ago
  American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.
- city41 15y ago
  My bank is about to roll out a new online banking system. They are requiring us to create a new password for the new system. So in order to log into the new system for the first time, they emailed us telling us to email them back a 6 digit pin to identify ourselves for the first login. My response is to start looking for a new bank.
HoLyVieR 15y ago
Enforcing PIN style password for bank is not that bad, as long as they use other factor to identify you.
andrewflnr 15y ago
My school only gives you a four-digit numeric PIN, and it defaults to your birth date.

fossuser 15y ago

One site I used (I think it was T-Mobile) simply removed characters from your password without even telling you. That took me a while to figure out.

techdmn 15y ago

I have an issue with att where a complex generated password was accepted as a new password, is rejected on the initial log-in page, then accepted on a subsequent "bad username / password" page. Fun and games.

windsurfer 15y ago

The rules for my university are: * 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed

alanh 15y ago
Does your university have a mathematics department? … sigh
jackvalentine 15y ago
Mine are: "The new password is to be chosen as a combination of alphabetics, digits and special characters. It must be eight characters long and contain one of the special printable characters (eg $ - ! : / = _). Normal alphabetic characters are case sensitive ie "a" is not the same as "A". Special characters may not appear at the beginning or end."
- drdaeman 15y ago
  > It must be While it's almost the exact opposite of [0-9]{4,6}, it's extremely annoying too. This is fairly secure for usual website password, but the requirements would throw this away: $ openssl rand -base64 9 TjB3tbYOo1wz Okay, it's fine when you generate a random password for each site (then store it somewhere), but if you're generating password from some one-side function from a site URI, then you have a problem.