This is a rant about dumb password policies enforced by some websites or apps. If you see these password rules forced to you, try to stay away if possible.
Can’t use special characters, or use a pre-defined special characters only
Are you storing the password in plaintext that your database will break when have special characters?
Password can’t be longer than X characters
Most probably storing the password in plaintext and their database column is limited to those characters limit.
Password expire every X months, without notice, suddenly can’t login. Reset it and can’t use the last 5 passwords
They store your previous passwords, either encrypted or plaintext.
Most places where I’ve seen those annoying rules are official websites of my country’s institutions… Hard to make do without them.
My old bank would reject passwords that didn’t start with a letter. Numbers and symbols were required, but you couldn’t use them as the first character for some reason. Infuriating.
They don’t need to store previous passwords to prevent reuse, they just need to store the hashes. This is safe.
I forgot my password to a local government site once and they emailed me my plaintext password. Wtf.
There was a service in a company I worked for that also send you your password in plain text by email. I reported it to the infosec department and they were like yeah, we know, but the system is not important and we don’t care. Mf don’t know that people reuse their passwords everywhere??
Have you played the password game yet?
