8 ms·
My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password
by robotears 5y ago
My frustration isn't just the sites that make the password rules clear after I submit the form. The worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me (which seems to happen in more places than it should).
- jer0me 5y agoI'm not super knowledgeable about these kinds of things, but aren't hashes usually a fixed length? Why would it matter how long your password is?
- randomluck040 5y agoWait, what? That never happened to me. How do you go and find out your password then? Trial and error?
- phepranto 5y agoThey might just truncate the password during login as well. I was able to login to my online banking using only the first five digits of my password not more than 3 years ago.. They fixed it in the meantime but I'm still worried.
- robocat 5y agoYou should still be worried, since any bank storing an unhashed password clearly has security fail.
- ylere 5y agoI had it happen a few times. Usually I would reset it a few times until realizing that it's obviously not saving the password I'm entering, at which point I would try a setting a shorter one.
- deleted 5y ago[deleted]
- Maultasche 5y agoThat happened to me many years ago with Microsoft logins. They were truncating passwords to 12 characters and my generated 16-character passwords never worked. I kept resetting them over and over until I did a Google search for Microsoft password requirements and found out that they were being truncated. That was likely fixed a long time ago, but I'm still wary of increasing my Microsoft passwords past 12 characters.
- GoblinSlayer 5y agoFWIW I use 30 character password with recently created skype account, and relogins work.
- mooreds 5y ago> Trial and error? Bingo. Super frustrating. See also this comment: https://news.ycombinator.com/item?id=24827031 https://news.ycombinator.com/item?id=24827031
- Macha 5y agoI once had a bank that used substr(tolower(input_password), 0, 8) as the actual password.
- bell-cot 5y agoHeh. Late 1990's, I was an admin on a >1,000 user system - which was rooted because it had that feature, and another admin figured that 'meatball2&balloons' was a secure-enough password.
- teawrecks 5y agoT-Mobile did this to me a few years ago. Don't know if they still do, but I couldn't believe anyone thought that was ok.
- jbarberu 5y agoAnd then their sign-in page doesn't truncate it and it just fails to login... Absolutely love it! One of my favorites was Nintendo's user account. The web allows decent passwords when created, but then the actual game console only has room for inputting 15 characters or so for the password :@
- kevincox 5y agoI've even seen it backwards (I assume) where creating the account with the longer password worked but then I couldn't sign in with it or any prefix of it.
- deleted 5y ago[deleted]
- reaperducer 5y agoThe worst sites are the ones that truncate my generated password to fit their maximum password length and then don't tell me Or worse, they truncate your password after you've already used it for years and years. I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated my password. The password was stored in my password manager, so I knew I wasn't entering it wrong. BoA support said I should use the "change password" feature to update my password, but I couldn't because it requires me to enter the old password, which it would not accept. For some reason I can't remember, I couldn't use the "forgot password" feature. Maybe it also didn't work right. I spent an entire day on the phone getting bounced from person to person before finally someone was able to take a new password over the phone. Since Bank of America can't figure out how to build a web site login, I no longer trust it with my money. I emptied that savings account and paid off the credit card as quickly as I could. I no longer use BoA.
- pbhjpbhj 5y agoSo, for a bank the maximum is to allow NSA to crack it if they wish, right?
- reaperducer 5y agoThey kept insisting that a 20-character password is safer than one with 30 characters. I couldn't get them to understand otherwise.
- genewitch 5y agoOn nsa.gov for a long time the max password length was 12 characters. Last checked in 2016.
- nzach 5y ago>Or worse, they truncate your password after you've already used it for years and years. Worse than that must be the sudden realization that your bank probably saves your password in plain text somewhere.
- throwawayboise 5y agoSupermicro BMC passwords do that. Recently (i.e. this year) I set up a bunch of servers and was setting the BMC password to a known value. Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error). When I tried to log in with this password, the login was rejected. However if I log in with just the first 20 characters of the password, it works.
- sleavey 5y agoThey should at least make their sign-up and login password fields have the same max length attributes...
- zamadatix 5y agoIt's even worse than that the BMC is a preconfigured part of the server not something you go to a sign up page for. It's literally the _change password functionality_ that does not warn/error on the password being too long!
- throwawayboise 5y agoI had seen the same thing on a (much older) switch, which is the only reason I thought to try truncating my password. Worked after dropping only one character, I was sort of expecting it to be 16 or maybe even 8.
- nulbyte 5y ago> However if I log in with just the first 20 characters of the password, it works. Even worse is when the password change form accepts more characters and processes them correctly, only to have the login form not allow you to enter all characters. If I'm not mistaken, the business remote deposit portal my bank uses does this.
- justusw 5y agoCould that mean that the password is stored unhashed?
- dataflow 5y agoCan I ask what length your passwords are (roughly)? I don't understand the motivation for anything long in the context of randomly generated passwords for websites. 8-10 characters should be plenty. (This isn't to excuse silent truncation.)
- iso1631 5y agoIf you're using a random password, c29b90b0e25ece3f2dabcef496d22103 is fine for a password, 2^128 bits. It's a right pain to type in on a console though. On the other hand, "rundown skyline pluck shawl pastrami radar refueling poach prankster durable" is far easier to type and is about the same entropy
- hannasanarion 5y agoThe entropy is far greater than 2^128. Pastrami, refueling, and shawl don't appear in the top 30,000 English words list, so even knowing your password generation strategy, every word adds at least 15 bits of entropy, you're up to 150 bits, probably more.
- iso1631 5y agoMy word list contains 7227 words apparently, so 12.82 bits per word https://github.com/redacted/XKCD-password-generator https://github.com/redacted/XKCD-password-generator Not sure how many bits a "good" password should be nowadays.
- Larrikin 5y agoOutside of things that need to be extremely secure like my AWS account password I usually prefer readable random words passwords over random text. Even random 2 word passwords usually surpass 20 characters especially after adding in numbers and special characters most sites require. It's a lot nicer being able to check if I typed in my Peacock login at my parents home at a glance versus a string of random characters.
- loa_in_ 5y agoMy passwords are all 20+ characters long
- memco 5y agoI've also had fun experiences where the "special characters" differ in the description than in the implementation in a few ways. Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation. Another issue I've seen is that the password was required to have only a certain subset of non-alphanumeric characters, but it did not explain or validate this client side so I had a password for which all the boxes turned green, but was still invalid. In both cases only trial and error worked to find a valid password.
- Causality1 5y agoI spent half a year being charged monthly by Microsoft because Google considers my email address the same whether or not it has a period in it but Microsoft had somehow split my account into two based on that difference.
- NackerHughes 5y agoI'm missing something, why would they charge you monthly for that?
- hansvm 5y agoExtra user fee on some kind of SAAS?
- Causality1 5y agoXbox Live Gold. I'd call, give them my account details, and the rep would tell me it was canceled. Three months later, another bill. Called my bank and had my card replaced, three months later somehow again another bill on my new card. After that I figured out what was going on and managed to cancel the account. I was a teenager at the time.
- stormbrew 5y agothat's.. really on you I think, and not at all similar to one site having differing validation rules in different places for the same data. What gmail does there isn't some kind of standard, it's a unique special feature google does. You don't want other sites getting clever about this sort of thing, because if the rules change much worse things will happen. Now, sites that treat email addresses as case sensitive - those are evil.
- hnlmorg 5y agoEE does this on their website but not on their mobile app. Took me ages of debugging to figure out why my password manager worked on one platform but not the other. I was so annoyed when I realised what it was.
- Zircom 5y agoYeah you'd be surprised where it happens. I used to work on the help desk for a company that operated nuclear power plants, and their password system would only accept 8 character passwords, alphanumeric only. However, the length checking would randomly fail and users would be able to set a longer password and the system would silently truncate it without throwing an error or alerting the user in any way.
- davchana 5y agoExactly. Indian Retirement Fund, PF, National Pension System, has a rule of max 16 chara in password. They don't tell this at password reset or set. They simply accept anything 16+ length; & silently truncate & use the first 16 chars. But user is never told. When I try to login later, it says password wrong. I had to reset it multiple times, because my password manager was generating longer ones.
- teawrecks 5y agoThis has happened to me on one site. As far as I'm concerned, this is just a bug.
- thamer 5y agoWorse: I once set my E*Trade password to something it accepted but wouldn't recognize when I tried to log in… because it was too long. After changing it I got locked out of my account and had to call support to resolve the issue. The worst part was that after verifying my identity over the phone they kept sending me reset links and I kept using long passwords generated by 1Password (30 characters IIRC) and it always accepted them when resetting but still would never let me log in. It took many attempts and new reset links until they suggested trying a shorter password, which was eventually accepted both during reset AND login. Of course the reset page didn't mention a maximum length.
- zhynn 5y agoIt gets worse: if you use 2fa the security code generated by the symantec thing is just appended to the password, so if your password is still a valid length, but then the 2fa takes it over 30 chars, it fails. It is the worst.
- Pxtl 5y agoIf they truncate on password set but don't truncate on password validation, that's the worst.
- EmilioMartinez 5y agoMy favorite one was a site that capped the password length in the creation form in a way you couldn't tell it was being truncated, but then let you enter any length when you logged in. And being a finance thing, it blocked your password after three attempts.