3 ms·
It's also important to width-test fields. Never forget to make sure that WWWWWWWWWWWW doesn't cause weird application wrapping.
by munk-a 5y ago
It's also important to width-test fields. Never forget to make sure that WWWWWWWWWWWW doesn't cause weird application wrapping.
- aidenn0 5y agoI used a system where the maximum length on the "new password" field in the change password form was longer than the password field in the login form. The symptom was that I could login if I used my password manager browser plugin, but not if I pasted it from my password manager.
- joe_guy 5y agoNot fully related but you reminded me of this. Around the time of AOL3 or early AOL4 someone found a user name exploit. When making a new account, on the client side use winapi's EM_LIMITTEXT to bypass the max character limit on the input textbox. Enter one or two letters, a bunch of spaces, then some more letters. The server side would truncate to the original length, leaving you with a one or two letter username, working around the 3+ requirement.
- TechieKid 5y agoDiscover (discover.com) currently has a similar bug where it'll allow me to login with my password, but will not accept the same password in the 'Change password' workflow as the old password, complaining about it being invalid. (shrug)
- kevinmgranger 5y agoYou're lucky they weren't different lengths in the backend. I've been bitten by that surprise one too many times (which is any number higher than zero)
- a1369209993 5y ago> one too many times (which is any number higher than zero) Nitpick: if the number is higher than one, then it's at least two times too many.
- aidenn0 5y agoThe most ridiculous thing is the UI for setting the password even said "X-Y characters long, must include at least one..." but the login page could not support Y characters.
- munk-a 5y agoI maintained a system where we had unbounded password length... but only respected the first six characters of the password. (we did fix that).
- bradknowles 5y agoSounds like some banks I’ve heard of.
- aidenn0 5y agoUnix passwords worked that way for 8 characters for many years due to the crypt algorithm used.
- stzsch 5y agoIIRC VNC passwords are still like this.
- pferde 5y agoI have seen a windows app with a text field whose max character count was somehow determined by system font size - probably a crude way to make sure the entered text fits the hard-coded field size. The problem was that this field was used to enter a 10-digit code, and as it turns out, on default Windows10 system, the fonts are set up so that this field only fit 8 of them. Oops! :)
- munk-a 5y agoI'd like to see how that App would work with me sitting here fonts cranked up to 175%. I've never heard of a setup like that though - it sounds like it'd be surprisingly intricate to actually configure.
- amarshall 5y agoRelated (we do this at my work): https://en.wikipedia.org/wiki/Pseudolocalization https://en.wikipedia.org/wiki/Pseudolocalization