Hacker News Reader

Comment by MrMember | Hacker News Reader

The password requirements at my job are, in my opinion, insane. It has to be a specified length (an exact number of characters, no more, no less), can't contain any 3+ character words found in a dictionary, and a few other requirements like at least one capital letter and at least one number. And it has to change every three months. So yes, when I have to change my password I end up changing a single character or digit and calling it a day.

View on HN

I've heard of banks setting a 8-character limit on password length.

If my bank did that, I'd be searching for a new bank. Just just reeks of passwords being stored in plain text.

IBM legacy in action. Nobody ever got fired for buying IBM, but some of them probably should have been.

IBM? AT&T, more likely. Unix had an 8 character limit long after people knew better.

Nothing would surprise me less than banks implementing a bank user accessing the bank via the website as a Unix user on a system.

I used to use a major local bank which had (and still has) a 6 character limit on password length. For real. Also, no symbols allowed.

ING Australia [1] only supports a four-digit PIN. Seems to work fine for them; I haven't heard of anyone losing money as a result.

[1]: https://www.ing.com.au/securebanking/

4-digit PIN with probably lots of protection/detection against bruteforcing (e.g. you only get 3 tries before you're locked out, then you have to go physically verify your identity and change the PIN again) and it's a bank so naturally everything is already being monitored.

To bad it needs to be a specific length, these would work otherwise:

(+ (CAR hn) 1)

And the variation:

(LET ((hn '(1 2 3))) (+ (CAR hn) 1)

This one works as well :)

STRCPY(str2, str1)

You might be able to even meet the length requirements by padding with some comment characters. You might even use the comment char from a different language than the one the statement is in teeheehee.

Some use chess moves, others poetry lines, why not use code ;)

When a place requires a specific number of characters, that sets off all kinds of alarms in my head. It makes me think they are storing the password rather than a hash derived from the password.

Reply on news.ycombinator.com