The Lounge - CodeProject

First Prev Next

Re: Password restrictions

OriginalGriff12-Dec-19 2:32

OriginalGriff

12-Dec-19 2:32

I had one some years ago: a friends mother had signed up with a password she could remember - her daughter's first pet, a cat called "PEPSI". And this worked for ages, until the company was bought out by one with more restrictive passwords. When she replaced the computer, she couldn't sign in to her email any more because the password was wrong. And she couldn't change it because they required her old password to set a new one and that wasn't valid under their new rules ... It took some long drawn out phone conversations to sort that one out.

"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!

Re: Password restrictions

musefan12-Dec-19 3:43

musefan

12-Dec-19 3:43

Just when you think you're getting used to all the stupid in the world, something comes along and breaks the mould.

Why would anybody put validation on the login password. It just belongs on the "new" and "confirm" fields! D'Oh! | :doh:

Re: Password restrictions

phil.o12-Dec-19 2:36

phil.o

12-Dec-19 2:36

I would be annoyed to have such a limitation. Passwords shouldn't be stored in clear text in the first place anyway, but rather salted and hashed, so I don't see any reason to limit the character set (except maybe for control characters).

"Five fruits and vegetables a day? What a joke!
Personally, after the third watermelon, I'm full."

Re: Password restrictions

Cp-Coder12-Dec-19 2:37

Cp-Coder

12-Dec-19 2:37

My ISP gives you an IP address with a password (which YOU can change). When you point your browser to the IP address, You enter a page where you can configure many of the router parameters. (Dangerous in some hands! OMG | :OMG:

) You have full control of the router and WiFi passwords. Nice (for me, at least.) Smile | :)

Re: Password restrictions

dbrenth12-Dec-19 4:36

dbrenth

12-Dec-19 4:36

Mine does the same, except the router apparently runs past their software as well. I actually tried to log into my router to change the password myself. My error message was "Cannot connect to the internet!"

So I couldn't connect to the internet and I couldn't change the password so I could connect to the internet.

Brent

Re: Password restrictions

Cp-Coder12-Dec-19 4:40

Cp-Coder

12-Dec-19 4:40

Quote:
So I couldn't connect to the internet and I couldn't change the password so I could connect to the internet

All I can say is: 'Rats!' Sigh | :sigh:

My ISP is Spectrum. I have never had similar issues with their equipment.

Re: Password restrictions

den2k8812-Dec-19 3:12

den2k88

12-Dec-19 3:12

Passwords should be hashed so who cares about the characters? I would allow only printable ASCII though because those are universal and won't create problems in case of bad / strange keyboard configuration.

Still a lot of characters for passwords.

GCS d--(d+) s-/++ a C++++ U+++ P- L+@ E-- W++ N+ o+ K- w+++ O? M-- V? PS+ PE- Y+ PGP t+ 5? X R+++ tv-- b+(+++) DI+++ D++ G e++ h--- r+++ y+++* Weapons extension: ma- k++ F+2 X

Re: Password restrictions

kalberts13-Dec-19 6:49

kalberts

13-Dec-19 6:49

I prefer the Kerberos strategy: You send no password at all across the network. You send a request for a "ticket", a proof that you are entitled to use a specific service. This request need not be encrypted at all (well, maybe if you want to keep it a secret that you make use of that service, but in any case, a MITM will see which IP address you go to).

In return you get a ticket that is encrypted with your password. You decrypt it locally, at your own PC, and enclose it with your requests to the service.

Part of the ticket is encrypted with the password of the service, so you can't fix it up to give you any rights that you are not entitled to. The ticket is valid for a limited period (like 8 hours), so if anyone steals it, they can't use it the next day. The ticket may contain your IP address, so that service requests from an intruder on a different IP address are rejected. It may contain a one-time encryption key that you can use for the session with the service; the service will find the corresponding key in the part encrypted with the service's key.

I think the Kerberos strategy is so great that I cannot understand why it hasn't been universally adopted. It certainly is not because we have something that is a lot better. It seems like web service developers simply do not know about it, which is a pity.

Re: Password restrictions

DRHuff12-Dec-19 5:31

DRHuff

12-Dec-19 5:31

I am fine with that as long as they remember to change their prompt to:

"Enter yourpassword"

so that I still know what to type in...

I, for one, like Roman Numerals.

Re: Password restrictions

honey the codewitch12-Dec-19 6:35

honey the codewitch

12-Dec-19 6:35

All of my passwords must include a gang sign.

When I was growin' up, I was the smartest kid I knew. Maybe that was just because I didn't know that many kids. All I know is now I feel the opposite.

Password restrictions - aarrrggghhhh

bVagadishnu12-Dec-19 7:17

bVagadishnu

12-Dec-19 7:17

On a site I needed to register an account, they had a restriction for password to be at least 8 characters. Full stop.
I entered a password of 14 characters and got an error message: password too short.
After a uselessly long effort to get past the %#$%#&%#&# smart menu on the phone where none of the options addressed my issue, I eventually got to a(n alleged) human.
I had entered a password with upper, lower, numeric, and special characters.
Turns out only characters that appear on a phone are allowed.
It would seem the der who wrote the (regex?) validation only returned one error response to me - password too short
D'Oh! | :doh:

But I never wave bye bye

Re: Password restrictions

DumpsterJuice13-Dec-19 8:54

DumpsterJuice

13-Dec-19 8:54

Well someone had to say it. Passwords, no matter how complex, are easily hack-able.
This is what BitCoin depends on, they call them "Miners".

The only difference, is that Transactions in Bit Coin, are much more complex, and harder to
crack than any password you can come up with, or (Generate).

2-factor (Cell phone) - is being touted as a cure, but once they get in, they have your phone
number, and can easily change profile setting to be their (burner) phone.

The fuss about the lengths, characters, and all that.... is also frustrating.

You could depend on the hacker to take the easier way out, and not spend the time to crack
a good password... but then again, it may incent them to spend the "crack time" , because
of the implication of it being a special case, which might reward the extra time.

Yes, I said "Crack time".

Keep It Simple, keep it moving.

Re: Password restrictions

abh55513-Dec-19 19:43

abh555

13-Dec-19 19:43

You might want to have a look at the NIST document"Digital Identity Guidelines": NIST Special Publication 800-63B[^]

The guidelines have been updated this year, and specifically reverse some prior password policies that have been found to encourage bad behavior, like using post-it notes stuck to your monitor. It's boring reading though, here's a good summary: NIST 800-63 Password Guidelines - Security Boulevard[^]

Re: Password restrictions

Gluups13-Dec-19 19:43

Gluups

13-Dec-19 19:43

To me it seems obvious that the message should be "To improve the security, you are invited to create a new password respecting rules described at this page (link). Please do that before February 25th, problems can appear afterwards."
And of course, for obvious security reasons, you can access the site with your previous password.

Re: Password restrictions

Kirk 1038982113-Dec-19 14:16

Kirk 10389821

13-Dec-19 14:16

Here's an interesting take. They should have allowed you to enter whatever you think your password was.

They only had to address it when RESETTING it.
And quite frankly, they should be hashing your password to death, with enough salt to raise the blood pressure of a cadaver!
hash = GoodHashOf( PASSWORD, username, date account created, date password was set, password, USERID);
Where every comma is really + "SALT" + and each repetition is different salt. And should be userID dependent.

FINALLY, their site should have only mentioned the extra characters are no longer allowed on a password failed page!

I really hate when people don't allow ";" (I understand the SQL Injection filters. But if you are not using bind variables, you should be beaten and shot and beaten again... LOL

Re: Password restrictions

Brady Kelly31-Dec-19 5:45

Brady Kelly

31-Dec-19 5:45

I restrict nothing, nor require digits or special chars, but most of all I don't limit length, and encourage my users to use a long, easy to remember pass-phrase.

"'Do what thou wilt...' is to bid Stars to shine, Vines to bear grapes, Water to seek its level; man is the only being in Nature that has striven to set himself at odds with himself."
—Aleister Crowley

CCC OTD

Duncan Edwards Jones11-Dec-19 23:29

Duncan Edwards Jones

11-Dec-19 23:29

"Due to a mix up alarm made my breakfast sweeter" (9)

Re: CCC OTD

OriginalGriff11-Dec-19 23:32

OriginalGriff

11-Dec-19 23:32

MARMELADE!

"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!

Re: CCC OTD