3 ms·

I hope this catches on. I hate making 30+ character passwords only to be told I need to add capitals and whatnot to be secure.

jjeaff 4y ago
And then some sites throw salt in the wound by requiring "at least one special character that is not # or % or whatever" so if you turn on special chars for your password generator, you have to manually filter through it to pull out said characters.
- rekoil 4y ago
  Or how about "Sorry, your password may be at most 12 characters long". Grinds my bloody gears. What irritates me more is knowing that the people who implement those solutions are probably here. Shame on you, go back and fix it right now!
  - bacheaul 4y ago
    More likely, people who are here are forced to implement security policies adopted by cybersecurity teams that have long since left the company, and the current cyber teams have no incentive or desire to changed said policies.
  - fbdab103 4y ago
    My favorite faux security thing I have run observed in the wild: Login with your password. Site then responds that we emailed you a security code, but the security code expires in five minutes. Immediately below that, it notes that the email may take up to four minutes to send. From experience, I think the note about slow emails is accurate. Who spent more than 30 seconds on that implementation thinking it was acceptable? Note that this is for a stupid intra-company fitness tracking thing (ie, I do not care at all about this data). Confirmation codes from my bank have a 30 minute window, but that is evidently too lax for step counting.
    - pbhjpbhj 4y ago
      AliExpress! They give you something like 30s to enter the "2FA" code to log in, only it takes ~20s for the SMS to get to me. Took me 3 tries.
      - atoav 4y ago
        As someone who just a week ago implemented a similar thing: SMS sucks. Sending it can take any amount of time it seems. Sometimes <10s sometimes a minute or more and unless you get a report from your provider you don't know which it was. The only reasonable solution was to adjust the timeout of the sent token.
      - hyperman1 4y ago
        Last time I was there, I actually couldn't get the login screen to appear. Clicking login grays the site out and draw 2 useless horizontal lines. Only clicking 'create account' and then switching to 'already have an account' gives me a login screen. As a bonus, mistranslations are so bad the text on the 'create account' and 'already have an account' are identical. You have to guess which dialog is which. All of this on firefox with ad blocker, maybe chrome is better. Now that whole site has the weirdest bugs. When I go to the mailbox, the site switches to some eastern european language. The things we do for cheap electronic components ...
  - smileybarry 4y ago
    Yeah, love how my bank has a password length requirement of "8 to 14 characters".
  - deleted 4y ago
    [deleted]
- bigiain 4y ago
  If a password rule looks dumb enough, I sometimes try using something like this for a password: '; DROP TABLE users; -- just for the lulz...
  - azinman2 4y ago
    You just gave away your password to the world…
    - pbhjpbhj 4y ago
      I don't think his password is actually ************ though ...
      - LoganDark 4y ago
        hunter2
- Fire-Dragon-DoL 4y ago
  Or you find one of those lovely sites where the password has a max length and they tell you it, but instead of validating, they truncate the password and save silently. Oh, of course they truncate also the password confirmation field.
  - cafeinux 4y ago
    My favourite is when you enter a long password, and it fails with the error message "Your password must contain special characters" or some other message that nothing to do with the condition that is not met.
    - Yoric 4y ago
      My favorite must have been the website that informed me that my password was invalid, when it actually didn't like my last name (forgot the specifics – I think that's because there was a dash in the name?)
xfiderek 4y ago
Why does it even matter? Don't you use a password manager to generate passwords for you?
- kijin 4y ago
  The strings generated by password managers are often incompatible with arbitrary requirements imposed by websites. You must use a symbol, but some symbols are forbidden and we're not going to tell you which ones! You can't have more than N consecutive numbers! Your password is too long! It must be exactly 15 characters long! etc. etc. So I restrict my password manager to use what I consider to be a widely accepted subset of the printable characters, and then some random website will complain about the lack of this or that character. :(
- atoav 4y ago
  Everybody who uses a password manager encounters stupid password rules regularily. It matters, because it is annoying. Password security rules should achieve two goals: 1. Actually improve security 2. Make it easy for users to choose a good password A password policy of "chose one or more lowercase, one or more uppercase, two or more numeric and at least one special character, but not the one that you have been thinking of" does not achieve that goal, especially if they limit the password length to 15 characters. Just tell give them a reasonable minimum length, check against the most common passwords and their username and call it a day. If you need more security, increase the minimum length. Maximum length should be chosen in a way that nobody who is not malicious will notice it (e.g. 128 chars or bigger). This produces safe passwords, is understandable and people with password managers are served as well.
atoav 4y ago
Just yesterday I had a form ask me to use a special character, one or more lowercase characters, one or more uppercase characters and two (!?) or more numbers. The password must be between 6 and 15 characters long. What kind of absolute maniac comes up with such a password policy? Demanding friggin' two numbers and then limiting the password length to ridculous 15 characters?

jjeaff 4y ago

And then some sites throw salt in the wound by requiring "at least one special character that is not # or % or whatever" so if you turn on special chars for your password generator, you have to manually filter through it to pull out said characters.

rekoil 4y ago
Or how about "Sorry, your password may be at most 12 characters long". Grinds my bloody gears. What irritates me more is knowing that the people who implement those solutions are probably here. Shame on you, go back and fix it right now!
- bacheaul 4y ago
  More likely, people who are here are forced to implement security policies adopted by cybersecurity teams that have long since left the company, and the current cyber teams have no incentive or desire to changed said policies.
- fbdab103 4y ago
  My favorite faux security thing I have run observed in the wild: Login with your password. Site then responds that we emailed you a security code, but the security code expires in five minutes. Immediately below that, it notes that the email may take up to four minutes to send. From experience, I think the note about slow emails is accurate. Who spent more than 30 seconds on that implementation thinking it was acceptable? Note that this is for a stupid intra-company fitness tracking thing (ie, I do not care at all about this data). Confirmation codes from my bank have a 30 minute window, but that is evidently too lax for step counting.
  - pbhjpbhj 4y ago
    AliExpress! They give you something like 30s to enter the "2FA" code to log in, only it takes ~20s for the SMS to get to me. Took me 3 tries.
    - atoav 4y ago
      As someone who just a week ago implemented a similar thing: SMS sucks. Sending it can take any amount of time it seems. Sometimes <10s sometimes a minute or more and unless you get a report from your provider you don't know which it was. The only reasonable solution was to adjust the timeout of the sent token.
    - hyperman1 4y ago
      Last time I was there, I actually couldn't get the login screen to appear. Clicking login grays the site out and draw 2 useless horizontal lines. Only clicking 'create account' and then switching to 'already have an account' gives me a login screen. As a bonus, mistranslations are so bad the text on the 'create account' and 'already have an account' are identical. You have to guess which dialog is which. All of this on firefox with ad blocker, maybe chrome is better. Now that whole site has the weirdest bugs. When I go to the mailbox, the site switches to some eastern european language. The things we do for cheap electronic components ...
- smileybarry 4y ago
  Yeah, love how my bank has a password length requirement of "8 to 14 characters".
- deleted 4y ago
  [deleted]
bigiain 4y ago
If a password rule looks dumb enough, I sometimes try using something like this for a password: '; DROP TABLE users; -- just for the lulz...
- azinman2 4y ago
  You just gave away your password to the world…
  - pbhjpbhj 4y ago
    I don't think his password is actually ************ though ...
    - LoganDark 4y ago
      hunter2
Fire-Dragon-DoL 4y ago
Or you find one of those lovely sites where the password has a max length and they tell you it, but instead of validating, they truncate the password and save silently. Oh, of course they truncate also the password confirmation field.
- cafeinux 4y ago
  My favourite is when you enter a long password, and it fails with the error message "Your password must contain special characters" or some other message that nothing to do with the condition that is not met.
  - Yoric 4y ago
    My favorite must have been the website that informed me that my password was invalid, when it actually didn't like my last name (forgot the specifics – I think that's because there was a dash in the name?)

xfiderek 4y ago

Why does it even matter? Don't you use a password manager to generate passwords for you?

kijin 4y ago
The strings generated by password managers are often incompatible with arbitrary requirements imposed by websites. You must use a symbol, but some symbols are forbidden and we're not going to tell you which ones! You can't have more than N consecutive numbers! Your password is too long! It must be exactly 15 characters long! etc. etc. So I restrict my password manager to use what I consider to be a widely accepted subset of the printable characters, and then some random website will complain about the lack of this or that character. :(
atoav 4y ago
Everybody who uses a password manager encounters stupid password rules regularily. It matters, because it is annoying. Password security rules should achieve two goals: 1. Actually improve security 2. Make it easy for users to choose a good password A password policy of "chose one or more lowercase, one or more uppercase, two or more numeric and at least one special character, but not the one that you have been thinking of" does not achieve that goal, especially if they limit the password length to 15 characters. Just tell give them a reasonable minimum length, check against the most common passwords and their username and call it a day. If you need more security, increase the minimum length. Maximum length should be chosen in a way that nobody who is not malicious will notice it (e.g. 128 chars or bigger). This produces safe passwords, is understandable and people with password managers are served as well.

atoav 4y ago

Just yesterday I had a form ask me to use a special character, one or more lowercase characters, one or more uppercase characters and two (!?) or more numbers. The password must be between 6 and 15 characters long. What kind of absolute maniac comes up with such a password policy? Demanding friggin' two numbers and then limiting the password length to ridculous 15 characters?