4 ms·

I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have string

I absolutely love the concept behind the site. I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy. My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.

gorjusborg 4y ago
Oh, and if you have a maximum password length, I don't trust you with my data.
- madamelic 4y ago
  Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration. That one is a fun one to find out.
  - throwaway742 4y ago
    T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN. Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security
  - happymellon 4y ago
    HSBC UK does this.
  - WelcomeShorty 4y ago
    Swiss bank Cler is guilty of this too, in a way. At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.
- reidjs 4y ago
  You can’t just let users paste in 18,000 characters you need to limit the password length somewhere. But I agree a limit less than 255 chars is insane.
  - gorjusborg 4y ago
    > You can’t just let users paste in 18,000 characters Thank you for speaking up. And here it is: I don't trust you with my data. Passwords should not be stored in a database. Period. So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size. If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data. Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.
NickBusey 4y ago
Disabling paste anywhere is a cardinal sin. “We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”
- madamelic 4y ago
  My favorite is when sites completely disable pasting my bank account number. Oh, let me get out my bifocals and checkbook that I copying from... and definitely not my online banking we've had for two decades+.
- _fat_santa 4y ago
  I wonder, what is the rationale for this "security feature"?
  - outcoldman 4y ago
    Wise for example, allowed me paste the password for creating account or changing the password. Password was 20 characters long, but seems like they cut it on client side or backend to 15. So when you login, it does not cut the password, and I never could figure out why I could not login in some places. So one dump rule creates another
amlozano 4y ago
TreasuryDirect.gov should get a special callout for forcing you to use an on screen keyboard to click your password, with of course paste disabled.
duffn 4y ago
I'm glad you enjoy it! If you have any sites you like to add, please feel free to contribute. https://github.com/duffn/dumb-password-rules/blob/main/CONTRIBUTING.md https://github.com/duffn/dumb-password-rules/blob/main/CONTR...

gorjusborg 4y ago

Oh, and if you have a maximum password length, I don't trust you with my data.

madamelic 4y ago
Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration. That one is a fun one to find out.
- throwaway742 4y ago
  T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN. Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security
- happymellon 4y ago
  HSBC UK does this.
- WelcomeShorty 4y ago
  Swiss bank Cler is guilty of this too, in a way. At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.
reidjs 4y ago
You can’t just let users paste in 18,000 characters you need to limit the password length somewhere. But I agree a limit less than 255 chars is insane.
- gorjusborg 4y ago
  > You can’t just let users paste in 18,000 characters Thank you for speaking up. And here it is: I don't trust you with my data. Passwords should not be stored in a database. Period. So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size. If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data. Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.

NickBusey 4y ago

Disabling paste anywhere is a cardinal sin. “We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”

madamelic 4y ago
My favorite is when sites completely disable pasting my bank account number. Oh, let me get out my bifocals and checkbook that I copying from... and definitely not my online banking we've had for two decades+.
_fat_santa 4y ago
I wonder, what is the rationale for this "security feature"?
- outcoldman 4y ago
  Wise for example, allowed me paste the password for creating account or changing the password. Password was 20 characters long, but seems like they cut it on client side or backend to 15. So when you login, it does not cut the password, and I never could figure out why I could not login in some places. So one dump rule creates another

amlozano 4y ago

TreasuryDirect.gov should get a special callout for forcing you to use an on screen keyboard to click your password, with of course paste disabled.

duffn 4y ago

I'm glad you enjoy it! If you have any sites you like to add, please feel free to contribute. https://github.com/duffn/dumb-password-rules/blob/main/CONTRIBUTING.md https://github.com/duffn/dumb-password-rules/blob/main/CONTR...