Hacker News Reader

Comment by arkitaip | Hacker News Reader

The worst example that I've seen has to be the site that could only handle password per {6,12}[A-Za-z0-9] - incredible.

Oh, I remember another one that's just as annoying. This site simply chopped of your password after n characters and it never gave you any kind of warning. Took a lot of troubleshooting to find out the exact position of n.

View on HN

One site I used (I think it was T-Mobile) simply removed characters from your password without even telling you. That took me a while to figure out.

Think about all-numeric PIN style passwords. I have seen banking websites that enforce [0-9]{4,6}

My bank limits you to 20 characters, which I'll grant is decent. But: NO non-alphanumerics, and, get this, is case insensitive.

This may just convince me to switch banks...

My bank is about to roll out a new online banking system. They are requiring us to create a new password for the new system. So in order to log into the new system for the first time, they emailed us telling us to email them back a 6 digit pin to identify ourselves for the first login. My response is to start looking for a new bank.

American Express' passwords are now case-insensitive too. Incredibly, this still qualifies as a slight improvement over their previous password regime, which used a maximum of eight characters, few "special" characters accepted.

Yes, I was just going to mention banks as well. I have dealt with multiple online banking systems for major banks that enforced ridiculously low maximum password lengths and alphanumeric-only restrictions. It's one thing for Electronic Arts to have not thought through this stuff, but another entirely when you're talking about a banking system.

My school only gives you a four-digit numeric PIN, and it defaults to your birth date.

Enforcing PIN style password for bank is not that bad, as long as they use other factor to identify you.

I have an issue with att where a complex generated password was accepted as a new password, is rejected on the initial log-in page, then accepted on a subsequent "bad username / password" page. Fun and games.

The rules for my university are:

* 7 to 8 characters long * Must contain at least one of each: non-capitalized letter, capitalized letter, and a number * No special characters allowed

Mine are:

"The new password is to be chosen as a combination of alphabetics, digits and special characters. It must be eight characters long and contain one of the special printable characters (eg $ - ! : / = _). Normal alphabetic characters are case sensitive ie "a" is not the same as "A". Special characters may not appear at the beginning or end."

> It must be

While it's almost the exact opposite of [0-9]{4,6}, it's extremely annoying too.

This is fairly secure for usual website password, but the requirements would throw this away:

    $ openssl rand -base64 9
    TjB3tbYOo1wz

Okay, it's fine when you generate a random password for each site (then store it somewhere), but if you're generating password from some one-side function from a site URI, then you have a problem.

Does your university have a mathematics department? … sigh

Reply on news.ycombinator.com