I just hate it when a program or website has a MAXIMUM password length, and despise even more when the password requirements/limits aren't shown on the page. "Failed to update password" WHY!? WHY DID IT FAIL!? Oh, you think 16 characters is enough? Were my extra 70 bytes of storage space hurting your margins?
I use a password manager and I've twice seen a website not let me in with my saved credentials, and on resetting my account discovering that the maximum password length is now shorter than the password I have been using for months. If you are going to change the password constraints, fine, but you could allow login once and immediately force a password change.
I’ve seen it one step further. I can’t remember what the service was, but I signed up for it and copy pasted the password into my password manager, then tried to sign in with it. Couldn’t. Went back and forth with the “forgot my password” page about three times before I realized that not only was there a limit to the text length: you auto-truncated my input upon saving with no indication to me
I've run into that before too. The extra stupid part was the app was different than their website so the password worked on one but I had to drop some characters to use it on the other.
Correct me if I'm wrong, but if websites store your password in plain text, that's already bad enough. As far as I'm aware basic hashing - as in taking the password and transforming it into a fixed length sequence - is (or at least should be) common sense.
So if credentials are stored as a hash (or a fixed sequence), then the only logical reason for enforcing a limit on password length should be hash collisions (which are only possible if you're using a terrible hashing algorithm). I don't really know what I wanted to say with this, my brain just spontaneously jumped to hashing and the bunch.
I appreciate your comment anyway! I didn't know passwords would be hashed to a consistent length - I can see how that would be more secure.
I don't think in the cases that I mentioned, that the hash of my entered/saved/extralong password was being compared to the stored hash they had on file, I think what happened is the input field validation was changed and would no longer allow a password that was valid under their previous rules.
and despise even more when the password requirements/limits aren’t shown on the page
When they drip-feed you just one requirement at a time, only telling you one requirement that your chosen password doesn't meet, and then they'll tell you one more requirement that your next password doesn't meet...
At that point you just slap random letters and numbers without paying attention and then waste an hour+ contacting IT to get it reset because you "forgot" and got locked out.
Password policy is mostly bullshit anyway since most "hackers" these days are just performing social engineering on morons with no sense in order to get in.
There is actually a lot more to this: a lot of people in the it sec crowd have been saying for many years that this habit of the gibberish passwords with symbols capitals and whatnot is actually a net deficit in security. Mostly because for the longest time people had to mostly remember all passwords and the policies for rotation were to aggressive (which lead to "lazy" changes). Nowadays unfortunately we still have people that inherited this thinking and still enforce this, but you also see a lot of people understanding that pass phrases are a lot better (of course should not be a predictable phrase like good morning, but it is possible to make it much better with way less effort)
Password policy is mostly bullshit anyway since most “hackers” these days are just performing social engineering on morons with no sense in order to get in.
Ah, now I get it. That's why they enforce password policies that make the password impossible to remember -- you can't give a hacker your password if you don't know your password! Genius!
Me, as I pour some water on myself: Oh, look, it doesn't damage me at all, in fact, it feels kinda nice! Let's see how well you deal with water being poured on you!
Computer: Your, password is fine, actually, nothing else needed!
Me: No, no, you are gonna find out what happens when I pour water into you power supply.
Computer: No need for that! You know, Linda really is a bitch! You have been dealing with a...
Me Pouring water: Yes, she is, isn't she?
Computer makes some fizzle, and pop noises, then completely silent, monitor blank: ...
Active Directory by default does not enforce a minimum password age. If you have a good strong one already that you know isn't compromised, you could just spam 24 password changes as fast as you want and boom. Your old password drops out of the history and can be used again.
My company’s password policy requires, among many other things, “no repeating characters”. Like what the Christ. How does all this bullshit make it more secure? I store my login in a password manager with far looser requirements, so fuck yo security
Part of your password was found in our database of passwords that have been compromised by someone somewhere. No we're not going to tell you which part. Pick a new password.
36 Comments
Blue_Morpho@lemmy.world · 36 pts · 23d
Ok, I'll capitalize the first letter and add an exclamation point to the end. Happy?
I bet brute force hash checkers assume the first letter is capitalized because of current password policies.
jaybone@lemmy.zip · 11 pts · 23d
The hacker known as 4chan.
anomnom@sh.itjust.works · 3 pts · 23d
I used to capitalize the last 2-3 when I still picked passwords. But now I less my keychain app do it all.
clay_pidgin@sh.itjust.works · 32 pts · 23d
I just hate it when a program or website has a MAXIMUM password length, and despise even more when the password requirements/limits aren't shown on the page. "Failed to update password" WHY!? WHY DID IT FAIL!? Oh, you think 16 characters is enough? Were my extra 70 bytes of storage space hurting your margins?
I use a password manager and I've twice seen a website not let me in with my saved credentials, and on resetting my account discovering that the maximum password length is now shorter than the password I have been using for months. If you are going to change the password constraints, fine, but you could allow login once and immediately force a password change.
JustAnotherKay@lemmy.world · 20 pts · 23d
I’ve seen it one step further. I can’t remember what the service was, but I signed up for it and copy pasted the password into my password manager, then tried to sign in with it. Couldn’t. Went back and forth with the “forgot my password” page about three times before I realized that not only was there a limit to the text length: you auto-truncated my input upon saving with no indication to me
clay_pidgin@sh.itjust.works · 6 pts · 23d
That's so annoying!
I've also seen a login form where the username field also has the password type, so my password manager pastes the password in both!
nforminvasion@lemmy.world · 4 pts · 23d
Believe it not, straight to jail.
lightnsfw@reddthat.com · 4 pts · 23d
I've run into that before too. The extra stupid part was the app was different than their website so the password worked on one but I had to drop some characters to use it on the other.
Nat997@lemmy.blahaj.zone · 12 pts · 23d
Correct me if I'm wrong, but if websites store your password in plain text, that's already bad enough. As far as I'm aware basic hashing - as in taking the password and transforming it into a fixed length sequence - is (or at least should be) common sense. So if credentials are stored as a hash (or a fixed sequence), then the only logical reason for enforcing a limit on password length should be hash collisions (which are only possible if you're using a terrible hashing algorithm). I don't really know what I wanted to say with this, my brain just spontaneously jumped to hashing and the bunch.
marcos@lemmy.world · 8 pts · 23d
It's somewhat common to limit password lengths to avoid DoS attacks that exploit a slow key generation function.
But that limitation should on some hundreds or a few thousands characters. Sites that use limits like "16" are probably storing them as plain text.
clay_pidgin@sh.itjust.works · 4 pts · 23d
I appreciate your comment anyway! I didn't know passwords would be hashed to a consistent length - I can see how that would be more secure.
I don't think in the cases that I mentioned, that the hash of my entered/saved/extralong password was being compared to the stored hash they had on file, I think what happened is the input field validation was changed and would no longer allow a password that was valid under their previous rules.
OwOarchist@pawb.social · 7 pts · 23d
When they drip-feed you just one requirement at a time, only telling you one requirement that your chosen password doesn't meet, and then they'll tell you one more requirement that your next password doesn't meet...
clay_pidgin@sh.itjust.works · 5 pts · 23d
Maybe don't play this game...https://neal.fun/password-game/
Grostleton@lemmy.dbzer0.com · 26 pts · 23d
At that point you just slap random letters and numbers without paying attention and then waste an hour+ contacting IT to get it reset because you "forgot" and got locked out.
Password policy is mostly bullshit anyway since most "hackers" these days are just performing social engineering on morons with no sense in order to get in.
ZeDoTelhado@lemmy.world · 20 pts · 23d
There is actually a lot more to this: a lot of people in the it sec crowd have been saying for many years that this habit of the gibberish passwords with symbols capitals and whatnot is actually a net deficit in security. Mostly because for the longest time people had to mostly remember all passwords and the policies for rotation were to aggressive (which lead to "lazy" changes). Nowadays unfortunately we still have people that inherited this thinking and still enforce this, but you also see a lot of people understanding that pass phrases are a lot better (of course should not be a predictable phrase like good morning, but it is possible to make it much better with way less effort)
agamemnonymous@sh.itjust.works · 7 pts · 23d
Correct horse battery staple
Hasherm0n@lemmy.world · 2 pts · 23d
More that just "... a lot of people..." NIST themselves published real research backing this up over a decade ago.
OwOarchist@pawb.social · 8 pts · 23d
Ah, now I get it. That's why they enforce password policies that make the password impossible to remember -- you can't give a hacker your password if you don't know your password! Genius!
Jiggle_Physics@quokk.au · 18 pts · 23d
Me, as I pour some water on myself: Oh, look, it doesn't damage me at all, in fact, it feels kinda nice! Let's see how well you deal with water being poured on you!
Computer: Your, password is fine, actually, nothing else needed!
Me: No, no, you are gonna find out what happens when I pour water into you power supply.
Computer: No need for that! You know, Linda really is a bitch! You have been dealing with a...
Me Pouring water: Yes, she is, isn't she?
Computer makes some fizzle, and pop noises, then completely silent, monitor blank: ...
shininghero@pawb.social · 13 pts · 23d
Active Directory by default does not enforce a minimum password age. If you have a good strong one already that you know isn't compromised, you could just spam 24 password changes as fast as you want and boom. Your old password drops out of the history and can be used again.
AngryCommieKender@lemmy.world · 8 pts · 23d
https://xkcd.com/936/
LeFrog@discuss.tchncs.de · 7 pts · 23d
On the other hand:
https://xkcd.com/538/
baggachipz@sh.itjust.works · 7 pts · 23d
My company’s password policy requires, among many other things, “no repeating characters”. Like what the Christ. How does all this bullshit make it more secure? I store my login in a password manager with far looser requirements, so fuck yo security
terranoid@lemmy.cafe · 4 pts · 23d
Me: uses random string from password manager
Computer: password not secure enough
Me: provides 30 randomly selected words from a large dictionary and a cryptographically secure random number generator
Computer: no no I meant add a
!to the end, really yell your password. Make me think you mean it :)darthsundhaft@piefed.social · 7 pts · 23d
For those wondering, sudo in Linux can be configured to insult you when you get your password wrong.
I am not making this up...
DanceMomsSavedMe@lemmy.zip · 6 pts · 23d
This is what I feel like as the user every time I have to dual boot into Windows.
Not the password thing. Just the overall way the computer treats me
FiniteBanjo@feddit.online · 5 pts · 23d
Are you okay?
Some_Emo_Chick@lemmy.world · 9 pts · 23d
I'll be alright. sniff
lightnsfw@reddthat.com · 5 pts · 23d
Part of your password was found in our database of passwords that have been compromised by someone somewhere. No we're not going to tell you which part. Pick a new password.
MutantTailThing@lemmy.world · 3 pts · 23d
Just roll your face across your entire keyboard three times.
Makhno@lemmy.world · 2 pts · 23d
Hahaha Oh Linda! Its always Linda isnt it, folks?
laugh track to shitty generic joke
Viceversa@lemmy.world · 1 pts · 23d
Are you Linda or her associate?
ThatWeirdGuy1001@lemmy.world · 2 pts · 23d
New password cannot be the same as old password
Etterra@discuss.online · 2 pts · 23d
When it's for something I don't like, I like to include a nice insult in there.
unemployedclaquer@sopuli.xyz · 2 pts · 23d
I told ma to pretend she is Linda Hamilton, not sure that worked
ndupont@lemmy.blahaj.zone · 0 pts · 23d
Wow, what kind of prompt do you need to have Claude talk back to you like that?