This is a rant about dumb password policies enforced by some websites or apps. If you see these password rules forced to you, try to stay away if possible.
Can’t use special characters, or use a pre-defined special characters only
Are you storing the password in plaintext that your database will break when have special characters?
Password can’t be longer than X characters
Most probably storing the password in plaintext and their database column is limited to those characters limit.
Password expire every X months, without notice, suddenly can’t login. Reset it and can’t use the last 5 passwords
They store your previous passwords, either encrypted or plaintext.
Places like Flickr can go fuck themselves because they want 12-character password limits. 12! Some people can barely even remember a 6 string password much less one that’s 12.
Why 12? “SECURITY!” they’d spam. I’ve found it more secure to have a mix of special characters, lowercase/uppercase and numbers than the longer string of a password. Just means you’re going to increase the volume of people having to reset their passwords now and then because you required them to make it 12 characters long.
I don’t understand why people would like 12 characters…
Those don’t necessarily mean they’re storing in plain text.
I forgot my password to a local government site once and they emailed me my plaintext password. Wtf.
There was a service in a company I worked for that also send you your password in plain text by email. I reported it to the infosec department and they were like yeah, we know, but the system is not important and we don’t care. Mf don’t know that people reuse their passwords everywhere??
“Cannot use a sequence of characters used in any previous password,” or “Cannot use a previous password backwards.” Those are sure fire indicators that they’re storing your passwords in plain text.
I used to have a bank that had the first rule. Emphasis: Used to.
And putting an upperbound length limit on passwords is pants-on-head loony, unless the length limit is very large, like 1024 characters or something. Especially if it’s going to be hashed anyway.
Some password hashing functions have a maximum input length. That could be a reason for some of the requirements. E.g. if I remember correctly, bcrypt used a maximum of 60 characters, while still being an ok choice for a hashing function
The biggest red flag is when they try and stop you from pasting your password (or anything else for that matter) breaking password managers.
There are years-long arguments on social media with companies who do this with actual security experts telling them they’re hurting security (including referencing organisations like the UK’s National Cyber Security Centre) and their only response is “we don’t allow pasting for security reasons” but they can never explain how it helps security - because it doesn’t. It drives me mad.
I had one recently that (when changing / creating the password) would allow you paste into the “new password” field but not the “confirm password” field. Super annoying.
I just opened dev tools, pasted it into the “value” property for the control, and kept on truckin’. Just nuts that had to be done though.
