Hacker News Reader

Or when the system truncates a long password during password creation and doesn't tell you. Then when you log in, the full password fails.

http://kottke.org/12/06/the-worlds-worst-password-requiremen...

Sabre Red is great: 7 or 8 characters, no Q, no Z.

Amex website had their max password length of 8 characters. Not sure if they changed it. Even if you do have a system constraint, you could just lop off the extra characters and the user wouldn't probably never notice.

Mine is way more than eight characters (randomly generated w/ KeePassX), although I haven't tried truncating it to eight and seeing what happens.

According to the screen shot in the repo, it's not even case sensitive either.

Or they say cannot accept repeating characters. Like "2j4lwroiw4lkf9wwjsofserow111" is still bad because of 111.

Like Microsoft account passwords (at least for office 365). I don't understand why they do this.