Hacker News Reader

Comment by dudul | Hacker News Reader

I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years"

G0Fuc4Y@urse!f

To me this is a sure way that people are gonna pick horrible and stupid passwords.

View on HN

Even better if it just says "your password does not fit our requirements" :)

I was signing up for a bank account and had to make a password for my online account in the branch. Turns out my 16-character randomly generated password made the system unhappy. Tried 6 more times with newly generated passwords (character-only, alphanumeric only, alphanumeric and "#" or "$" only) and it just said the password was not acceptable. So in the end I used my probably ~15 bits of entropy super easy to crack password from when I was 10, with a few randomly generated characters on the end (because more than a few would make the system complain again).

The pervasiveness of poor UI and security design baffles me. You would've thought that one of the largest banks in the world would have a little more competency but nope.

> Your password must be at least 10 character long

You forgot "and may not be longer than 16 characters".

Unless they've changed it in the last couple months, TRowe Price still limits passwords to 10 characters. And this is after a recent "We've upgraded our security!" push where I had to reset everything.

I've seriously considered closing my accounts over it.

Edit: Yep, still as bad

Password must be 6-10 characters and contain at least 2 numbers and 2 letters. Password may not contain the following special characters: space , + " % & ' ; = ^ or curly braces.

my bank's password has to be exactly 8 characters and is case insensitive

it's pretty insane considering it's like the most important password I have

I've got one better: my online banking requires 7 digits exactly, numbers only. This is so you can use the same "password" in their phone banking thingy.

you just know they are storing it in a plaintext VARCHAR(16) column and not hashing it in any way ....

HRBlock does this.

And leave them in a post-it glued to their monitor

Depending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.

exactly -- that and write down those horrible and stupid passwords on sticky-notes and attach them to their monitor bezel or keyboard.

Reply on news.ycombinator.com