4 ms·
Oh, and if you have a maximum password length, I don't trust you with my data.
by gorjusborg 4y ago
Oh, and if you have a maximum password length, I don't trust you with my data.
- madamelic 4y agoOnly surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration. That one is a fun one to find out.
- throwaway742 4y agoT-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN. Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security
- happymellon 4y agoHSBC UK does this.
- WelcomeShorty 4y agoSwiss bank Cler is guilty of this too, in a way. At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.
- reidjs 4y agoYou can’t just let users paste in 18,000 characters you need to limit the password length somewhere. But I agree a limit less than 255 chars is insane.
- gorjusborg 4y ago> You can’t just let users paste in 18,000 characters Thank you for speaking up. And here it is: I don't trust you with my data. Passwords should not be stored in a database. Period. So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size. If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data. Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.