Hacker News Reader

Comment by glhaynes | Hacker News Reader

As a person who spent a long time today changing passwords (in part due to the Gawker thing, but I had been meaning to for a while), I have some very nasty things to say about how many sites have stupid restrictions on passwords - why do you care if I want a password that's longer than 8 characters? Why do you care if I want to include a non-alphanum in my password? wtf, really, why? It's easier to not have those restrictions on a field so why why why are you going to extra trouble to add them? Oh I'm getting mad just thinking about it.

View on HN

Yes, and they wait to tell you their arcane rules until after you've typed in the password that you want. So you have to repeat. It's like that teaching method I saw on Fernwood Tonight that simply shocked the learner for a wrong answer.

I can see reasons for requiring non-alphanumeric characters in a password (even though the reasoning behind that might not be valid). But why the hell you would want to forbid using them, is beyond me. Still I've seen this in pretty many sites, even modern ones.

Maybe they don't have proper parametrized queries and are afraid of SQL injections :)

I was amazed to find one my banks (Chase) limited the password to something like 12 characters when going through this same exercise yesterday.

The thing I found the worst about Chase is they require a number in your username. Not that the other restrictions aren't inane (6-12 char password, alphanumeric only, etc).

I know, right? And even more insane, they only allow alpha numerics, no symbols allowed. And for probably the only password which matters...

Yes, exactly. I was surprised how little correlation there was between how important the security of the site was and what quality of password was allowed by the site.

Some of that is archaic database tables (or using NIS/YP as the user manager in the backend). You didn't used to be able to start a password on AMEX's sites with a digit...

No bank should be storing passwords as plaintext, therefore the content of your password should not be their concern.

I don't think it's just about hashing. When I see restrictions on passwords or other fields, I always assume the worst. If < is not allowed, that's because your password will show up unencoded in HTML somewhere. If $ is not allowed, that's because somebody is afraid that it will actually be treated as a variable reference somewhere. Likewise & or % in URL-encoded data, ' or " in JavaScript, etc.

The most universal and silent restriction seems to be on NUL bytes.

Back-ended by non-RDBMS systems, the banks may be using something like YP or NIS to store passwords so that multiple systems can hit one, central authentication system. NIS had horrible password restriction issues (much like LANMAN).

Except that they should be storing the hash anyways.

What part of archaic was clear? rpc.yppaswd isn't gone...

I was amazed to find Paypal has a shorter limit than eBay.

To add, American Express puts a cap at 8 characters on their online services.

My bank password is 4 digits. But they ask another, one shot 4 digit password from a table they've sent to you when you actually move money. I thought all banks did this?

Mine uses an 8-digit password for the website, plus another 6-digit one for transactions. On top of that you have to authorize the computer you use (they send you an SMS with a code if you log in from a new computer).

I don't know how they uniquely identify your system, but the technology is Java-based.

People who really should know better: The British Computer Society (the UK IT professional organisation).

http://i.imgur.com/o5V7d.jpg

I discovered that Sallie Mae doesn't accept special characters.

And that iTunes now forces one capital letter. I dunno, I think if you've used a special character you should be forgiven for not using a uppercase letter

Reply on news.ycombinator.com