Context is that I had to register for a lot of accounts recently and some of the rules really make no sense.
Not name-and-shaming, but the best one I’ve seen recently is I might have accidentally performed an XSS attack on a career portal using a 40-digit randomly generated password…
Not sure if it falls under the same category, but the way Activision handles (handled? I haven’t used them since) passwords was atrocious! I had to reset my password to get back into my account, I used a random diceware password, it accepted it. However! The client on both Windows and Xbox wouldn’t let you input a password longer than I believe 20 characters. So while you can set a 25 character password, you can go fuck yourself if you actually wanna log in…
My work was using some MS-based account system, but I don’t know if this was stock or something they modified. When you had to change your password, it would tell you if your new password didn’t meet the password requirements, as usual. What it wouldn’t tell you was what those requirements were…
So yeah, the requirements the system won’t tell you about would have to be the worst one i came across…
Stupid bank app doesn’t allow password managers… and if you hit the enter button to login you get an error message informing you that you need to mouse click on the button.
I had a wi-fi device a few years ago that would require a password up to 12 characters, but that requirement wasn’t explicitly written anywhere. The device would gladly accept a 13-character password, for example, but you would never be able to log in again (factory-resetting was the only way to undo).
More recently I purchased a Lennox HVAC system that came with their proprietary thermostat (an Android tablet with a wall mount). During the Christmas break I got myself a new wi-fi router and had to reconfigure all my wireless devices. After 2 days, the Lennox thermostat was the last device to join the new wi-fi network… and it failed because their password could have any character EXCEPT the asterisk — and my new password had an asterisk. I didn’t like the idea of redoing all my other devices AGAIN just because of this idiotic password rule, so I ended up creating a new SSID just for the thermostat. I named it LENNOXSUCKS.
One special character.
Seems logic right? Until you get that it is one and one only. Took me some time.
Bug report time
Max length of something under 18 …
Irks my gears
I volunteer at a local high school and the students password is their birthday, because they are given their account at age 5, in kindergarten, and it’s something you can reasonably expect a 5 year old to remember. Also, the students are not allowed to change their password unless they get “hacked”, which is usually just another student logging into their account and deleting their assignments.
Password needs one special character.
Not at least one. Exactly one.I add to make a password last fall that had the requirement “numerals or special characters”. A password with both numerals and special characters wouldn’t work.
Probably the silliest thing I have run into was some game. It asked you to set two passwords. You needed both to login. The second password couldn’t be changed. This is why it was secure, see. (…What.)
When I created my account and set the second password, I couldn’t log on the second time. Because I had entered a 20 character second password. It was accepted and verified during the account creation just fine. On the second login, it only accepted 16 characters. (It let you enter 20 characters but said it was too long.) Trying to enter first 16 characters of the second password didn’t work, of course.
I then contacted the support, and they did manage to reset the second password anyway. (What is this even)
Worked somewhere that required security clearance that used your national insurance number (UK equivalent to SSN) as your login id. Most people in the UK do not memorise their NI number.
Password had to be uppercase and lowercase letters, numbers, and special characters, I think at least 12? Couldn’t have back to back special characters or start or end with numbers. No whole words, either.
So now you have to remember two strings of letters and numbers. Sackable offensive to write either down. I once got a phone call from security because I would miss enter my password after lunch first time around, just once a day, but they rang me up still to see what going on.
Security there was a nightmare, worked with an obviously disabled guy, who forgot to put his disabled badge on his car dashboard and they threatened to ban him from site (which would result in the sack as you couldn’t work remotely). The kicker was that they said we know you forgot to put the badge out, so they knew he was disabled as all car registrations are preregistered only way onsite.
I hate any password requirement that says “special characters” but has a list of exceptions, like no
. , ! ;or empty spaces. Just tell the user to make a passphrase, enforce at least one empty space and, dunno, 25 characters minimum, and bam. It’s not like hackers try brute force anymore, they just hack insecure DBs full of user data and use that everywhere.The worst I’ve ever seen was a site that required passwords to be 4 digits.
Any service that says I must have a 12 or 14 string password, combined with symbols, numbers and letters.
Do you know why, I have to keep resetting my password, services that have this dumb requirement? Because your fucking requirements are absurd and unnecessary. I don’t have the mental capacity to care to remember that long of a password. I have to have a document now of all of the passwords I have so it’s not forgotten. I have to have browsers autofill for me because of this shit.
In a perfect world, 6 - 8 string passwords would suffice and lots of emphasis on symbols and numbers at the very least. The longer you try making the characters of a password, the chances of forgetting increases.
Flickr does this. Some of the portals to my apartment portal does this. Portals to some of my medical information does this. It’s fucking bullshit. StateFarm does this too.
I wholeheartedly disagree A long password like “this is the best password for email” is near-impossible to brute-force, while being extremely easy to remember. A short password with special characters / numbers / lowercase + capital letters, like “Emai1_Passw0rd!” is far easier to brute-force, and a lot harder to remember (which letters did I capitalize again? Which ones did I swap with numbers? What symbol did I throw in?)
Optimal password requirements are … nothing. Because every requirement you put in reduces the parameter space an attacker needs to search. Second best is setting a minimum number of characters, because a bunch of people are stupid and will use single-letter passwords if you let them.
For me it’s the opposite - every password is generated, except for those websites that limit me to something unreasonably short like 14 chars. They need to accept longer passwords, so I can use a generated one with default complexity, not have to make up something easy to remember
Write it down
Then you’ll memorise it
Using a password manager is a lifesaver for this :) there are open source ones like KeePass and you can sync the encrypted file across devices using Dropbox or similar
My old bank required you to have a password 12 characters long exactly, and to login you have to give the characters in specific places.
I would ask you what are the 4th, 7th, and 11th letters of your password.
Anyone want to guess why that aren’t my bank anymore?
E and U and 2
Oh yeah, mine has that as one of the options, but they’ve beefed it up a little. You also have to enter your date of birth and then they send a text to a pre-arranged number with a further 6-digit PIN that also has to be used.
