Password length requirement
Password length requirement
Last week, I tried to register for a service and was really surprised by a password limit of 16 characters. Why on earth yould you impose such strict limits? Never heard of correct horse battery staple?
This is my biggest pet peeve. Password policies are largely mired in inaccurate conventional wisdom, even though we have good guidance docs from NIST on this.
Frustrating poor policy configs aside, this max length is a huge red flag, basically they are admitting that they store your password in plan text and aren’t hashing like they should be.
If a company tells you your password has a maximum length, they are untrustable with anything important.
The worst is when it either won't tell you what the character limit is so you have to just keep lowering it and retrying until it finally works, or when the infrastructure for signing up has a different character limit than the infrastructure for logging in, so you can sign up with a long password but can't actually sign in with it. I once encountered a website that had this issue for both the password AND username so I had to change my password and then contact support to change my username. Absurd.
Its even better when they don't tell you that your password is too long, and they truncate it somewhere unknown.
Tried a randomgen 32 character password at the local sheriff's office. Copy and pasted it directly out of my password manager into the password creation field so I know I didn't typo it and when I tried to login it wouldn't work. Took me a bit of troubleshooting to figure out what happened.
I got this from a bank. A BANK. Not only was it limited to 12 characters. THEY ALSO LIMITED THE SPECIAL CHARACTER SET.
I complained and was told, oh that's why we have the security number for (a unchanging six digit code), and I'm like, that's basically 1 password with 18 character limit and 6 of the characters are definitely numbers.
Not only that, 2FA is not available for logon, it just says "to authenticate certain types of Internet and Mobile Banking transactions".
I couldn't believe it. Surprise, surprise, there are no minimum password security regulations in Australia...
Eons ago, I got an account for using a software on an IBM mainframe. Keep in mind that the machine used masks with fixed-width text fields on the terminal (TN3270, IIRC), even for the login mask. Being security cautious, the first thing I did after login was to change my password. The "change password" mask allowed for passwords of up to 12 characters, which I used freely. I logged out, got back to the login mask - which only allowed for an eight character password...
Tell me about it. USAA has a password policy of "between 8 and 12 characters."
Like, that's not even secure under old understandings of secure. A max of 12 should be, like, an actual offense with sanctions attached if they get hacked at some point. Especially for a financial institution. Ridiculous.
Definitely used a one-off password for that one...
My current employer has the dumbest restrictions for passwords to our core system. It is a large regional bank. Our core system must have a password that is either 7 or 8 characters long (nothing shorter or longer). It cannot have any vowels or special characters. It cannot have any capital letters. It cannot have two numbers in a row.
Ran into this when I chose a password for my new work e-mail. As my employer is Chinese, error messages show up in mandarin, so it took me a while to understand what the problem was: Must be between 9 and 16 characters long.
Here is a screenshot from the page where my meme came from. But it it not the only company out there with ridiculous password policies.
Drives me nuts when this happens.
Dammit, I just spent 5 minutes rolling dice and flipping through a binder. One of us takes this shit seriously.
