I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy.
My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.
“We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”
Oh, let me get out my bifocals and checkbook that I copying from... and definitely not my online banking we've had for two decades+.
So one dump rule creates another
That one is a fun one to find out.
Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security
At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.
Thank you for speaking up. And here it is: I don't trust you with my data.
Passwords should not be stored in a database. Period.
So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size.
If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data.
Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.