Hacker News Reader

Comment by Udik | Hacker News Reader

I just wish websites would remind you of their password rules at login time. I use different passwords depending on what the password rules are, and you only get to see them at signup/ password recovery, which unfortunately tends to be quite often with certain websites or web apps.

View on HN

My favorite is sites that allow you to use any number of special characters when you sign up or change your password, but their login forms break when you try to use them. If there are rules, please enforce them on your sign-up form!

Amen, with a special F.U. to the sites that disallow special characters. What is the reason for that? (OK I might understand disallowing some uncommon chars but $%(^ etc shouldn't be disallowed)

Why block anything at all? If I want my password to be unicode and emoji, what's the downside to the site?

I assume they're hashing all the passwords anyway.

hint: they're not all hashing the passwords

I always wonder what kind of magic those websites do with the string. Hashing has become so simple. When you hash you don't have to worry about special chars (encoding issues though). It's only when you have bad practices that you should worry about ;") in the password field.

I wonder how many sites have been taking down by SQL injection attacks inside of a password. That would take something of a perfect storm of bad design, which is why I'm pretty sure there are sites out there that are vulnerable.

> I assume they're hashing all the passwords anyway.

Bad assumption. And many that do hash are using MD5 and don't bother salting.

> sites that disallow special characters

This is often an external code smell of not hashing the passwords but instead storing them as plaintext in a CHAR(8) field in a SQL database somewhere.

This. I often think that it would be very useful to have a website to check password requirements of multiple sites.

That is, a site were we would search for "gmail.com" and it would say "minimum 8 characters. 1 letter, 1 digit and 1 symbol mandatory" (made up example).

Then of course there could also be Firefox/Chrome extensions that would query this site and show the rules near login prompts.

I'd make it myself were it not for the lack of time... but if anyone wants to pick up the idea, there it is. I just ask for 10% of ad revenue :)

Reply on news.ycombinator.com