- Feature Articles
- CodeSOD
- Error'd
-
Forums
-
Other Articles
- Random Article
- Alex's Soapbox
- Announcements
- Best of…
- Best of Email
- Best of the Sidebar
- Bring Your Own Code
- Coded Smorgasbord
- Mandatory Fun Day
- Off Topic
- Representative Line
- News Roundup
- Editor's Soapbox
- Software on the Rocks
- Souvenir Potpourri
- Sponsor Post
- Tales from the Interview
- The Daily WTF: Live
- Virtudyne
Admin
Matthew's Staples one is very common nowadays. You'll also find more and more sites won't accept a single or double quote (' or ") either.
I suspect Matthew is correct about the ampersand - but that suggests they're passing the password unencrypted to a web service.
The quotations marks one seems more to be an attempt to avoid some kind of SQL (or similar) injection, which again, implies that they're pushing around unencrypted passwords.
Admin
You can't always fully hash on the client.
So maybe that they're not sure whether that's happening somewhere unknown deeper within their systems and want to be sure at every level.
Or maybe they've got a homebrew XML or JSON parser that might get confused with embedded quotes. Or they put the value into a querystring somewhere and are worried about url canonicalization errors.
If we hadn't built the web around everything being passed inter-machine and inter-language as strings with in-band signalling, we might have had some sanity. But noooo.
Admin
First example looks like something I encountered (I'm Dutch as well) last week (might even be the same application): it turned out that you could not just have e.g. "Capital99@", the numbers and special characters need to be hussled into the password, so "cAp99iTa@l" would be OK.
This seems to be done to discourage people to have "Capital character + anything + number +special character", as this would be too easy to crack, and people tend to only change the special character at the end when required to change their password.
Admin
6-12 characters? That's like protecting your valuables with a bead curtain, only worse - a would-be thief could get tangled up in the curtain.
Admin
I had a site that wouldn't allow a repeated character more than 2 times. I get not wanting aaaaaaaaaaaaaaaaaaa or something but it had all the usual "Upper Case", "Special Character", "Number", "16 characters+" requirement. What got me is that when you have a rotating password everyone just tacks on 1 at the end, and then changes it to 2, but then you wrap back around to 1 and just use 11, then 22, etc... Eventually you end up with 111 and can't use it.
Admin
For shits and giggles I decoded to let Firefox auto-generate me a password for some website I needed to register for. It wasn't accepted.
I spent a while scratching my head and taking things out and eventually discovered it had auto-generated a "<" into the string. Needless to say the HTML Gods were not amused.
Guess what? I make up my own random passwords now and I have never had one refused.
Admin
You shouldn't hash on the client, lest the hash becomes the password.
SQL has out-of-band parameters, yet so many sites eschew both that and the second-best solution (quoting) and employ user-visible filtering/blacklisting.
Admin
We just moved to a new web application firewall. Recently I had a customer that couldn't log in. The firewall had rejected their login attempt as hacking basically saying "Ohh, noo, someone's password has %39 in it, they're trying to do SQL injection".
No, it's a form field, not a URL. Please stop protecting us from being so stupid and to interpret posted data as URL encoded. Note that %39 in a form field is actually posted as %2539, so the software is assuming that after it's decoded by the framework that we're at risk of decoding it again.
Admin
Honestly, many sites probably just ban quotes, ampersands, etc. as a "belt and braces" approach to preventing issues. It doesn't necessarily mean they are passing plaintext passwords around insecurely, they just want to mitigate the consequences if some new development/integration/maintenance script/etc. happened to do so in the future.
Admin
Correct horse battery staple
Admin
In ye olden tymes, oneth thy IBM maineframe, password rules were something like this: The password can be up to 8 characters. All 26 letters, only uppercase (of course), numbers, and 4 national symbols are allowed; the first character must be a letter. So many things have changed that they now look like what it started with... oh, and of course that is MY luggage.
Admin
I suspect rejecting < and > came about as a result of the "Show password" feature that many sites now have while entering. They do this instead of generating proper HTML entities when adding the password to the HTML.
Admin
Password must be at least 18 characters long? What is this madness?
Admin
I wonder why handy is the German term for mobile phone (UK) or cell phone (US). Germany never had the personal handy-phone system. https://en.wikipedia.org/wiki/Personal_Handy-phone_System
Admin
Bosses want simple, easy, and fast solutions.
Stupid is simple, easy, and fast.
Admin
Well, better than the one I hit a couple of months ago--failed it once (I was planning on setting it to something simple on mobile, then changing it to something better when I had a real keyboard), then even an acceptable password was not acceptable. Had to abandon the whole sign-up and start over.
Admin
I imagine that's just a typo in the error message.
Admin
Honestly, I hate all these password policy restrictions because they don't do anything. Complex passwords only really protect you against brute force guessing attacks. And for those it's not the actual password that matters but the potential password domain. As in, as long as your domain of potential characters is wide enough 123456 is just as good as 12#@_6 because the attacker has to try all of them anyway.
Not that any of that matters since you can and should have a limit on the number of failed login attempts with a timeout. And because that's not how hacking accounts has worked for... 30 years now? Ever?
I mean, the whole thing is basically a defense against the TV hacker who tries to guess your password based off clues he picked up during the course of the show. Real hackers are either going to hack you, the person via phishing, break into some system that stores the passwords insecurely or just steal/buy hacked credentials online from someone who did. And using '3' instead of 'e' in your password is not going to protect you from those.
Admin
The site told me I need to have at least two special characters in my password, and now I'm stumped. I've never been asked to use more than one, and the only one I can think of is Forrest Gump!
Admin
Corporate standard. To be fair, most systems use SSO and for those that don't, passwords should be remembered by the browser or in a password manager and not have to be manually entered by the user.
Except that doesn't work for the non-SSO environments in this system, because Oracle have moved all their logins behind identical IDCS redirects, so the domain on the login page doesn't map 1-1 to the several possible environments you might be trying to log into. So your browser and/or password manager don't know which password to supply. I've taken to just leaving my password vault open in a browser tab so I can search for the appropriate environment, copy the password, and paste it into the login form.
Nope.
I had a recent mandatory cybersecurity refresher training course, which had the usual table (apparently made by some outfit called Hive Systems) of password length and character set vs time to hack, coloured green, yellow, and red according to supposed danger. I noted with some interest that "time to brute force: 2 billion years" only received a yellow grade... so I think there's some over-egging going on.
Admin
No one has ever been able to answer this question for me. Why do we need a long password to protect against brute force attacks of trying millions of possible passwords if my account is locked out after 3 unsuccessful attempts?
Admin
Because if the haxx0rz get the database file, and the passwords are stored correctly so they can't decrypt them, they can still brute force it on their own computer, which (obviously) won't increment the attempt counter.