Hacker News Reader

I encounter some bogus undocumented password constraints probably half the time I create an account. Usually it is a maximal length requirement that is not mentioned in the error message.

Don’t defend these idiotic practices.

View on HN

I'm not. The only time I've seen a maximum length password was like 10 years ago on Dell's IDRAC I think? I just don't think the complaints being thrown out here are good arguments.

Look at Microsoft's personal accounts (live.com or whatever they are calling it this week) - they still have this limit.

i just had it happen day before yesterday to create an account for a service to do a background check for a new job. it rejected my password without saying why and i could only get past it by shortening it to 15 characters.

and then the deeper question is, why do i need to create an account for this?

Not defending the max length, that's stupid and probably some old AS400 thing that got built into the system, but the account is for auditing obviously.

i don't see what's obvious. what is being audited? why is my email address needed when i'm giving them my id and ssn?

password too long is such a stupid reason to reject a password

Reply on news.ycombinator.com