5 ms·

The screen shot recommends short passwords with one each of upper/lower/numeric/special characters. This policy has never been good. I find it discouraging from

• GuB-42 5y ago
  I see that way too often. At least there isn't a maximum size here. The proper way to do it is to check with a compromised password database, and maybe with common rules like "your user name and password must be different". But I've almost never seen it used, I have used passwords that I know are compromised or even common, it always passed as long as it had the right characters. It shouldn't be that hard. Storage is cheap now, save a few GB for the entire haveibeenpwned database and you know you have a good password. There are even online services that do it securely and, I think, for free. The only real problem, I think, is a UX problem. Having to enter a password and being told repeatedly "haha, nope, try again" with no explicit way to correct it may be more annoying than clear rules but it doesn't strike me as an unsolvable problem.
  • plibither8 5y ago
    > At least there isn't a maximum size here. My bank does this, setting an maximum of 15 characters. It is an incredibly frustrating experience when I have to change my password (which I have to do every 6 months, per their "security" policy): I'm reminded of this ludicrous requirement of < 16 chars because most certainly they store these passwords in plain text. For context: this is the largest private bank in my country serving 50 million+ of customers.