In password security, the longer the better. With a password manager, using more than 24 characters is simple. Unless, of course, the secure password is not accepted due to its length. (In this case, through STOVE.)
Possibly indicating cleartext storage of a limited field (which is an absolute no-go), or suboptimal or lacking security practices.
Used to run into this more. Some legacy systems imposed password limits that seem archaic by modern standards. The authentication system was just supporting systems from before newer standards were created.
I think some of those compatibility layers outlived the systems they needed to be compatible with. The people that knew the system retired ages ago and the documentation was lost 3 or 4 “documentation system” changes ago.
Anyway, those have no place on the modern web.
You’ve got to stop all those who put: abcdefghijklmnopqrstuvwxyz
That’s my password for most things, any hackers die of RSI before they get in.
It’ll be caught by a dictionary attack. at least do something to break up their sequential order.
The password on my PC is something like 30 characters long. Back when win10 was first coming out, they were pushing getting an actual outlook account and tying that to your login. I was hesitant at first, but figured I’d try it out and see how that worked for me.
Turns out outlook accounts (at the time) had something like a 16 character limit on passwords. Bruh.
How about creating a new account, letting bitwarden create a password, only for them to send me a clear text copy of that passwod in their confirmation email…
i thought that practice died like 20 years ago
That means the breach is imminent, but at least you won’t need to worry about other accounts when it happens. Just be sure you don’t give them any kind of PII or financial data to save. No, you can’t save my card data to make shopping easier, because you’re almost certainly going to have a data breach next month, and drag your heels about disclosing it, giving hackers plenty of time to commit a bunch of fraud using all of the cards on file.
friendica does this.
…wut? Really?
Here’s your password, remember to write it down on your password post-it!
One of the accounts that I have to use at my job is like this but much much worse. It only accepts letters and numbers, no capitalization, no symbols and can only be 8 digits long maximum. It’s like they want to account to be easy to compromise.
That sounds like the limitations of an ancient mainframe system. If so, then someone trying to brute force their way in would be more likely to crash the system instead.
I had this problem with a fucking bank once. Even better are the sites that silently chop off characters after the internal limit, on the backend, but don’t tell you or limit the characters on the frontend. I had a really fun time with that last scenario once, resetting my password over and over and having it never work until I decided to just try a shorter password.
Obligatory https://neal.fun/password-game/
When that was first making the rounds I shared it with my coworkers. Most of my coworkers enjoyed it for a few minutes then moved on. One of my coworkers sent me a teams message 3 days later of the win message
Kudos for the dedication, I gave up at the fire thing
Yeah I never got passed the fire thing, or the egg hatching, whichever comes second
I don’t understand rule 5. “Digits shall add up to 25” I have a 1 and a 24, and it doesn’t accept it :(
figured it out, it adds digits, not numbers
My favorite is when they don’t have this check, but silently slice the string to meet the requirement, so that you can’t login with the original password the next time.
Metro Bank did something like this to me.
Wells Fargo used to do this. They cut my 16 character password to 8 and negated capitalization. Which is why I don’t use them anymore
amazon also had it a couple years ago
My bank used to do that back in the early 2000’s, I moved banks.
And then they store it in plain text anyway…
At one point years ago my work finally caught up with the 21st century and allowed creation of passwords longer than the fixed 8 characters it had always been. So I said great, made up something that was around 12 or so that I could remember. Until I logged into some terminal legacy programs we were still using and wouldn’t take that length. So yeah, I went back to 8 characters that wouldn’t break things. They eventually migrated away from such old programs and longer passwords became mandatory since they’d work everywhere, but I thought it was funny that briefly I tried to do the right thing but IT hadn’t thought out the whole picture yet.
oh. this has been a big pet peeve of mine for awhile. After starting to use password managers I figured I would standardize on the largest required characters only to find a source whos maximum characters were lower than anothers minimum characters.
When I banked with wells fucking fargo they had issues similar to this. I had something like a 16 character password and I once forgot the last character and it accepted it anyway, so there was some kind of character limit that they didn’t make obvious.
I also had a time I accidentally had caps lock on, and my password still was accepted. Their passwords were not case sensitive even though their password screen says they were.
That’s insane
Banks are the fucking worst for this. I assume it’s because they’re built on some 500 year old CICS mainframe.
What’s the point? no one is brute forcing a 12-15 password if the login system has ANY login attempt protection anyway.
This seems like one of the extreme overkill things…
That doesn’t help if someone got a list of their hashes somehow. Then an attacker can use their own system to crack them.
And that’s if they aren’t just storing the passwords as clear text to begin with, which length limitations are often a sign of.
Such a small max length is a good indicator they aren’t handling passwords correctly. A modern website should be able to send and hash kilobytes of text without the user seeing a significant delay. Having a max size like this sounds like they are storing the password as text instead of a hash.
Or some dumb project manager said passwords longer than 24 characters look bad in the UI and wanted the limit.
Do you check on login attempt protection behavior before creating accounts, and then choose your password length accordingly - longer or shorter?
i once used 20 for a bank. the website havent told me it was too long just clipped off 2 and accepted the rest. not even the banking support was able to help me. took me a few days to solve this by accident.
This shit always pisses me off. I’ve encountered it in like 2-3 places over the years since I started using a password manager, and every time it’s so frustrating and hard to figure out.
That must have been frustrating. How many times did it lock you out from trying again?
