80
submitted 1 year ago* (last edited 1 year ago) by techconsulnerd@programming.dev to c/mildlyinfuriating@lemmy.world

This is a rant about dumb password policies enforced by some websites or apps. If you see these password rules forced to you, try to stay away if possible.

Can't use special characters, or use a pre-defined special characters only

Are you storing the password in plaintext that your database will break when have special characters?

Password can't be longer than X characters

Most probably storing the password in plaintext and their database column is limited to those characters limit.

Password expire every X months, without notice, suddenly can't login. Reset it and can't use the last 5 passwords

They store your previous passwords, either encrypted or plaintext.

top 26 comments
sorted by: hot top controversial new old
[-] sijt@lemmy.world 41 points 1 year ago

The biggest red flag is when they try and stop you from pasting your password (or anything else for that matter) breaking password managers.

There are years-long arguments on social media with companies who do this with actual security experts telling them they’re hurting security (including referencing organisations like the UK’s National Cyber Security Centre) and their only response is “we don’t allow pasting for security reasons” but they can never explain how it helps security - because it doesn’t. It drives me mad.

[-] mrspaz@lemmy.world 10 points 1 year ago

I had one recently that (when changing / creating the password) would allow you paste into the "new password" field but not the "confirm password" field. Super annoying.

I just opened dev tools, pasted it into the "value" property for the control, and kept on truckin'. Just nuts that had to be done though.

[-] sijt@lemmy.world 5 points 1 year ago

Lots of sites do it on the email fields for some reason. I’m far more likely to miss type my email address, twice, than my password manager is likely to somehow complete it wrong.

[-] dual_sport_dork@lemmy.world 21 points 1 year ago

"Cannot use a sequence of characters used in any previous password," or "Cannot use a previous password backwards." Those are sure fire indicators that they're storing your passwords in plain text.

I used to have a bank that had the first rule. Emphasis: Used to.

And putting an upperbound length limit on passwords is pants-on-head loony, unless the length limit is very large, like 1024 characters or something. Especially if it's going to be hashed anyway.

[-] KHTangent@lemmy.world 7 points 1 year ago

Some password hashing functions have a maximum input length. That could be a reason for some of the requirements. E.g. if I remember correctly, bcrypt used a maximum of 60 characters, while still being an ok choice for a hashing function

[-] dual_sport_dork@lemmy.world 5 points 1 year ago

Well, sure. But in that case it should be the max length of whatever the hash method is. The full 60 characters, and not something dumb like 12.

[-] zockersanftmut@feddit.de 2 points 1 year ago* (last edited 1 year ago)

My bank has a rule that your password needs to be exactly 5 characters. It's completely nonsensical. Thankfully, a few years ago they at least implemented two factor authentication so there's some safety. Otherwise I would probably change to a different bank.

[-] jcabral9@lemmy.world 18 points 1 year ago

It's the worst when they make you solve a chess puzzle and today's wordle

[-] ReaderTunesOctopus@lemmy.world 10 points 1 year ago

All is fine until the eggs starts burning

[-] Ockenheimer@feddit.de 4 points 1 year ago

Paul starved two times….

[-] macarthur_park@lemmy.world 5 points 1 year ago

I overfed him :(

[-] sudoroot@lemmy.zip 13 points 1 year ago

Work for a hospital chain in IT and we have an application has a 1-10 character, no specials policy LOL

[-] 4am@lemmy.world 12 points 1 year ago

I forgot my password to a local government site once and they emailed me my plaintext password. Wtf.

[-] techconsulnerd@programming.dev 3 points 1 year ago

Happened to me too. Who's the dumb government vendor doing these applications?

[-] driving_crooner@lemmy.eco.br 3 points 1 year ago

There was a service in a company I worked for that also send you your password in plain text by email. I reported it to the infosec department and they were like yeah, we know, but the system is not important and we don't care. Mf don't know that people reuse their passwords everywhere??

[-] andyli@lemmy.world 9 points 1 year ago
[-] MilitantAtheist@lemmy.world 2 points 1 year ago

I have. The .fun domain is an insult.

[-] surewhynotlem@lemmy.world 9 points 1 year ago

They don't need to store previous passwords to prevent reuse, they just need to store the hashes. This is safe.

[-] techconsulnerd@programming.dev 4 points 1 year ago

You wouldn't know if they hash it or not.

[-] nogooduser@lemmy.world 12 points 1 year ago

You don’t know if they hash your current password either. Storing the last X passwords is not any reason to infer that they are plain text.

Chances are very good that they’ll hash previous passwords if they hash the current one.

[-] Falmarri@lemmy.world 9 points 1 year ago

Those don't necessarily mean they're storing in plain text.

[-] keeb420@kbin.social 7 points 1 year ago

My works payroll bullshit, you mightve heard of the company, makes us change the password every so often and it can't be one we used before. I work in a warehouse driving a forklift. There are people who can barely operate the computers they installed 5+ years ago still. It's dumb af. But no one would listen to me on it so I don't even bother.

[-] BradleyUffner@lemmy.world 4 points 1 year ago

My old bank would reject passwords that didn't start with a letter. Numbers and symbols were required, but you couldn't use them as the first character for some reason. Infuriating.

[-] MrMobius@sh.itjust.works 3 points 1 year ago

Most places where I've seen those annoying rules are official websites of my country's institutions... Hard to make do without them.

[-] soulifix@lemmy.world -5 points 1 year ago* (last edited 1 year ago)

Places like Flickr can go fuck themselves because they want 12-character password limits. 12! Some people can barely even remember a 6 string password much less one that's 12.

Why 12? "SECURITY!" they'd spam. I've found it more secure to have a mix of special characters, lowercase/uppercase and numbers than the longer string of a password. Just means you're going to increase the volume of people having to reset their passwords now and then because you required them to make it 12 characters long.

I don't understand why people would like 12 characters...

load more comments
view more: next ›
this post was submitted on 22 Jul 2023
80 points (95.5% liked)

Mildly Infuriating

35746 readers
498 users here now

Home to all things "Mildly Infuriating" Not infuriating, not enraging. Mildly Infuriating. All posts should reflect that.

I want my day mildly ruined, not completely ruined. Please remember to refrain from reposting old content. If you post a post from reddit it is good practice to include a link and credit the OP. I'm not about stealing content!

It's just good to get something in this website for casual viewing whilst refreshing original content is added overtime.


Rules:

1. Be Respectful


Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.

Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.

...


2. No Illegal Content


Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.

That means: -No promoting violence/threats against any individuals

-No CSA content or Revenge Porn

-No sharing private/personal information (Doxxing)

...


3. No Spam


Posting the same post, no matter the intent is against the rules.

-If you have posted content, please refrain from re-posting said content within this community.

-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.

-No posting Scams/Advertisements/Phishing Links/IP Grabbers

-No Bots, Bots will be banned from the community.

...


4. No Porn/ExplicitContent


-Do not post explicit content. Lemmy.World is not the instance for NSFW content.

-Do not post Gore or Shock Content.

...


5. No Enciting Harassment,Brigading, Doxxing or Witch Hunts


-Do not Brigade other Communities

-No calls to action against other communities/users within Lemmy or outside of Lemmy.

-No Witch Hunts against users/communities.

-No content that harasses members within or outside of the community.

...


6. NSFW should be behind NSFW tags.


-Content that is NSFW should be behind NSFW tags.

-Content that might be distressing should be kept behind NSFW tags.

...


7. Content should match the theme of this community.


-Content should be Mildly infuriating.

-At this time we permit content that is infuriating until an infuriating community is made available.

...


8. Reposting of Reddit content is permitted, try to credit the OC.


-Please consider crediting the OC when reposting content. A name of the user or a link to the original post is sufficient.

...

...


Also check out:

Partnered Communities:

1.Lemmy Review

2.Lemmy Be Wholesome

3.Lemmy Shitpost

4.No Stupid Questions

5.You Should Know

6.Credible Defense


Reach out to LillianVS for inclusion on the sidebar.

All communities included on the sidebar are to be made in compliance with the instance rules.

founded 2 years ago
MODERATORS