Hacker News Reader

Comment by lousken | Hacker News Reader

I think nowadays the bigger problem is that sites don't cooperate with password managers. I am trying to use 20character passwords and some sites still limit that number to 12 or 16. Also the fact that blizzard or steam doesn't use TOTP that google auth. uses pisses me off.

View on HN

Related problem: sites that don't let you paste into the password field - either when setting a password or trying to log in. To the people who do this: what do you think you're accomplishing? It's not going to stop somebody brute-forcing your site, and you're making it difficult to use a password manager.

In those cases, either I quit the site or, in a good mood, I open the dev tools...

Yeah, fortunately products like keepassx can auto-type into those fields, which works around the problem, but it's still absurd...

My favorite HN memory on this subject: https://news.ycombinator.com/item?id=4410350, "T-mobile password reset does not allow you to type the letter 'V'"

> Related problem: sites that don't let you paste into the password field

Run Firefox

Change this about:config option "dom.event.clipboardevents.enabled" to "false".

No more blocking of pasting into password fields by any site.

Sites with stupid Javascript isn't half the problem that mobile is. I still can't make in-app purchases on my iPhone because every time I try, Apple makes me put in my security question answers, which are random strings just like the passwords are, and then I get "your request has timed out."

Really I should be thanking Apple though for helping me save money.

I'm not familiar with the experience that you're describing; does an in-app purchase itself prompt security questions directly? Or do you need to reset your AppleID password and that's why you're getting security questions?

It probably needed those questions answered once, but he can't answer them in time so his account is stuck in the "needs to verify" state.

I managed to get it once, somehow, only to be asked again the next time.

been awhile since I have played (star/war)craft/throne/wings of liberty but I recall that blizzard specifically ignored capital letters. I could enter my password in without capitals and it worked fine. any thought to why this may occur?

I've never noticed that, because I never typed my password but I guess it's similar to what facebook[0] does in order to prevent caps lock issues?

[0] https://security.stackexchange.com/questions/68013/facebook-...

I still find sites that only allow 20 chars of a-zA-Z0-9. It should be criminal.

20? Haha, I've seen a limit of 10 this year (for my garbage collection company).

My bank (SMBC) requires exactly 4 digits for the online banking password...

Yeah, for some reason banks and credit card providers seem to be worse at this than anybody else.

Mine requires 6 digits to get in, but then for every real transaction I have to inform another 6 digits from an RSA app installed on my phone.

My bank used to do that. They finally switched to a fancy Web 2.0 interface a couple of years ago that let you use real passwords.

I have a password at work which is required to be EXACTLY eight characters, with no special characters.

Took me a long time to come up with a password.

That's secure enough if it's randomly generated.

Yes, but the limit being present at all potentially highlights a problem and it may be one of many. You shouldn't need an upper limit to password/passphrase size and if you have to have one because something breaks otherwise then the site really is doing something wrong. If they are getting that so wrong, what else problematical is sat waiting for Mr Hacker to discover?

I ran across a site with the most insane password requirements awhile back:

Some of this is from memory, so it might not be exact, but the requirements were:

1. Passwords must be exactly 14 characters long

2. Passwords must contain all 4 character classes (upper case, lower case, numbers, symbols)

3. Symbols must be from the set (! , . : ; " $ % & *) -- This wasn't specified, I had to figure it out from trial and error.

4. No more than two characters from any one class in a row (so aaBB is ok, aaaB is bad)

5. Passwords must be reset every 3 months

6. Passwords can not be similar to any previous passwords (it's vague what "similar" means)

7. Passwords must not be stored externally (IE, no copy/paste, no password managers)

Luckily I don't have to use that system anymore, because it was just completely awful. To be fair, they also had smartcards that didn't require this password nonsense, so I think the requirements were partially to encourage people to use the smartcards instead.

Reply on news.ycombinator.com