3 ms·

> Until a year ago, our passwords are 8 characters max, no special characters, upper and lowercase letters are equal. That’s pretty good. A major Canadian bank

> Until a year ago, our passwords are 8 characters max, no special characters, upper and lowercase letters are equal. That’s pretty good. A major Canadian bank until ~2020 had 6 character limit passwords (possibly you could enter more, but only the first six count) and mapped all alpha characters to numbers in groups of 3 (so your assigned telephone banking PIN was just a “hash” of your password). https://news.ycombinator.com/item?id=17174697 https://news.ycombinator.com/item?id=17174697

fragmede 3y ago
The best part is when the frontend input and backend validation get out of sync, so your password works sometimes depending on where you come in from.
- abustamam 3y ago
  My health insurance portal (Aetna, no I am not above naming and shaming) did something annoying. When I signed up I used a randomly generated three-word passphrase from my password manager. It was around 32 characters or something. They have the fun pattern of logging you out of your account whenever you are inactive. A bit excessive for a health insurance provider imo, but whatever. So I tried to login and guess what? Max input length for their login password is 16 characters. I literally couldn't input my password. I had to go through a stupid process to reset my password because their sign-up front-end validations were different from their sign-in front-end validations. I had to purposely choose a less secure password even though I could technically create a password that was pretty secure, I can't sign in with it.
  - freedomben 3y ago
    Heh, I had a health insurance portal that when you changed your password with their mobile app, it would let you use all the special characters. However the web app blocked (or stripped) those characters out, meaning you couldn't log in to the web app because it literally wouldn't let you type your password. Every so often the mobile app forced re-auth, and it redirected you to the web version where putting in your password wouldn't work... I likewise had a nightmare process to get it reset.
    - happymellon 3y ago
      Yes, I really dislike those companies that spend so much effort blocking pasting into the second password field when filling them out so they break password managers. Luckily it's normally easy enough to edit the tags on the text box but even so, this shouldn't be necessary. Fucking BT.
happymellon 3y ago
HSBC in the UK clipped passwords at the first 6 (maybe 8, I forget) characters. This is the problem with having old mainframes somewhere in the backend. Their rules bubble up even where it doesn't make sense.

fragmede 3y ago

The best part is when the frontend input and backend validation get out of sync, so your password works sometimes depending on where you come in from.

abustamam 3y ago
My health insurance portal (Aetna, no I am not above naming and shaming) did something annoying. When I signed up I used a randomly generated three-word passphrase from my password manager. It was around 32 characters or something. They have the fun pattern of logging you out of your account whenever you are inactive. A bit excessive for a health insurance provider imo, but whatever. So I tried to login and guess what? Max input length for their login password is 16 characters. I literally couldn't input my password. I had to go through a stupid process to reset my password because their sign-up front-end validations were different from their sign-in front-end validations. I had to purposely choose a less secure password even though I could technically create a password that was pretty secure, I can't sign in with it.
- freedomben 3y ago
  Heh, I had a health insurance portal that when you changed your password with their mobile app, it would let you use all the special characters. However the web app blocked (or stripped) those characters out, meaning you couldn't log in to the web app because it literally wouldn't let you type your password. Every so often the mobile app forced re-auth, and it redirected you to the web version where putting in your password wouldn't work... I likewise had a nightmare process to get it reset.
  - happymellon 3y ago
    Yes, I really dislike those companies that spend so much effort blocking pasting into the second password field when filling them out so they break password managers. Luckily it's normally easy enough to edit the tags on the text box but even so, this shouldn't be necessary. Fucking BT.

happymellon 3y ago

HSBC in the UK clipped passwords at the first 6 (maybe 8, I forget) characters. This is the problem with having old mainframes somewhere in the backend. Their rules bubble up even where it doesn't make sense.