4 ms·

By far the most frustrating password-handling sin I've encountered is when a website silently truncates the password field to some fixed length. This is especi

By far the most frustrating password-handling sin I've encountered is when a website silently truncates the password field to some fixed length. This is especially bad when you use a password-manager, as the password-manager will remember the full length password, which will be different than the truncated password the website is using. This wouldn't even be much of an issue if each website was at least consistent about truncating passwords, but often the account creation page and login page have different behavior (e.g. the account creation page truncates your password, but the login page doesn't, allowing your password manager to happily enter the full length password on the login page, thus resulting in a login failure). The first couple times this happened I was perplexed, but I've been burnt by this so many times now that I've resorted to opening up my web browser's devtools on any account creation page to check the password <input> for the maxlength attribute (because yes, many websites don't even mention the maximum length).

nybble41 5y ago
> but often the account creation page and login page have different behavior It's bad enough when that only applies to the length, but at least you could theoretically still log in once you knew what length it was truncated to. I've seen at least one banking site which had a narrower set of permitted symbols on the login page than the new account page. (Specifically, the login page didn't allow parentheses, but the new account page did.) Entering the correct password resulted in a form validation error, and of course if those symbols were removed then you still couldn't log in because it wasn't the right password. Fortunately the login page's validation rules were all client-side, and thus easily bypassed via devtools with basic JS debugging techniques. Once logged in you could change your password to something the login page would accept without messing with the scripts.

nybble41 5y ago

> but often the account creation page and login page have different behavior It's bad enough when that only applies to the length, but at least you could theoretically still log in once you knew what length it was truncated to. I've seen at least one banking site which had a narrower set of permitted symbols on the login page than the new account page. (Specifically, the login page didn't allow parentheses, but the new account page did.) Entering the correct password resulted in a form validation error, and of course if those symbols were removed then you still couldn't log in because it wasn't the right password. Fortunately the login page's validation rules were all client-side, and thus easily bypassed via devtools with basic JS debugging techniques. Once logged in you could change your password to something the login page would accept without messing with the scripts.