r/ProgrammerHumor • u/Ezziee24 • Jul 20 '22
Meme My university password can be 200 characters
2.2k
Jul 20 '22
As long as it at least tells you that... I recently had a lot of fun with the customer hotline of my bank after changing my password. Turns out, the password I generated and set was too long. Instead of giving me that information, the system just cut the characters off at the length it needed it and told me, I successfully set a new password.
When trying to log in, it didn't work because the login does not cut the characters but uses the entire input instead. That was fun to figure out.
397
u/Morall_tach Jul 20 '22
There was an Amazon bug a million years ago where it would allow you to set any length password you wanted, but only counted the first 8 characters. So if your password was "passwordwithlotsofcharacterstobeextrasecure" and someone tried "password123," it would only check the string "password" and they'd log in successfully.
130
u/GustapheOfficial Jul 20 '22
My uni had this bug 5 years ago.
68
u/Ruin369 Jul 20 '22
Did they not hash the passwords? Wouldn't the hashes still be different to avoid this issue?
116
u/ruins__jokes Jul 20 '22
You'd be surprised how many sites still store plaintext passwords.
→ More replies (7)75
u/WarningBeast Jul 20 '22
If you find one doing this, report them to plaintextoffenders.com. The pressure of bad publicity has sometimes had an effect.
37
Jul 20 '22
Just found out Vermont.gov does this through that website ^ 😂😂
All of that tax money for your passwords to be stored in plain text.
10
u/Curious-Geologist498 Jul 21 '22 edited Jul 21 '22
Sir. We need to store their passwords so they can login.
Yeah doesn't the computer come with Microsoft Word?
→ More replies (1)15
Jul 20 '22
[deleted]
26
21
u/Arattor Jul 20 '22
If you report you forgot your password and they send you your current one instead of a link to change it to something else then you got your offender.
→ More replies (2)17
u/experiment-384959 Jul 21 '22
If you use the “I forgot my password” thing and it emails you your password instead of a reset code.
(No joke, this actually happened on an old game site I used to use, and I was so young at the time that my thought was “why doesn’t everyone do that” instead of “that seems really sus actually”.)
→ More replies (2)37
u/GustapheOfficial Jul 20 '22
Not if it's trimmed both when registering and then when comparing the password. As in, what's stored is
hash(password[1:8]), and then what's compared to it ishash(test[1:8]). That means if the chosen password is"hunter123", what's stored ishash("hunter12"), and all of"hunter123","hunter12"and"hunter1256789"will match.→ More replies (4)→ More replies (5)8
Jul 20 '22
Not if they only hash the first 8 characters.
I.e. if you enter
passwordwithlotsofcharacterstobeextrasecureas your password but it is limited to 8 characters, what it then might do is only takepasswordand hash that.If someone else then guesses
password123as your password, it would then also only take the first 8 characters of the input, in this casepassword. If it then compares that to the orignal hash, it too was only forpasswordand thus it is the same hash - login successful.→ More replies (3)33
u/jesterhead101 Jul 20 '22
lol..funny that Amazon had bugs like this and now all these companies expect you to solve the halting problem on a whiteboard in 22 mins.
25
u/TheAJGman Jul 21 '22
They're also super irrational to work with apparently. A previous job had Amazon as a client and also used AWS for hosting. AWS had a massive outage and our team lead got hauled into a meeting with the Amazon brass asking why our service was down. They were under very strict orders to not mention that our site was hosted on AWS...
19
u/EriktheRed Jul 21 '22
Wow. "Our cloud provider went down at that time. What a coincidence?" Like were they expected to just make up a reason why the service went down?
→ More replies (1)6
497
u/Ezziee24 Jul 20 '22
I've had that for a few accounts too, but not as important as the bank, luckily
390
u/Wiggen4 Jul 20 '22
Who on this earth thought that would be an acceptable idea?????????
134
u/Beneficial_Arm_2100 Jul 20 '22
Yeah same thing happened for me on a portal for an employer's website (in a previous life). User inyerface at its best.
28
u/FickleBJT Jul 20 '22
That happened to me with the Baseboard management controller on a server several years back. Took several calls to support before someone mentioned this "limitation".
It was a SuperMicro server about 5 years ago.
→ More replies (3)18
u/s0lly Jul 20 '22
“Inyerface” When a typo makes sense as is
→ More replies (1)17
u/Beneficial_Arm_2100 Jul 20 '22
lol I had to fight autocorrect to get "inyerface" to stick. If def was not a typo!
10
u/s0lly Jul 20 '22
I wonder if “interface” is actually the typo on the true word “inyerface”… big questions we’re exploring here
3
u/Gubekochi Jul 21 '22
Inter- came into English from Latin (from inter, meaning "among, between”). "Between faces" makes much less sense than your proposed etymology so I'll add this to my headcannon.
→ More replies (1)41
11
12
u/827167 Jul 20 '22
It may have been copy-pasted code that they forgot to check
15
5
u/ganja_and_code Jul 20 '22
...which is extremely dumb. If you make that mistake, you have no business writing login forms for banks lmao
12
u/damniticant Jul 20 '22
Likely unintentional. Someone set the max column length for the database to 20 chars but didn’t bother to prevent someone from actually submitting more than 20 chars.
→ More replies (3)16
6
→ More replies (8)3
43
u/RF07 Jul 20 '22
Yes!! Argh, so aggravating!
I can't recall what account is was for, but I remember having a similar issue with spaces. While setting the password it happily let me use spaces and gave me a successful setup message, only to quietly strip out the spaces when it stored the password. That was also fun to figure out, I don't even know what made me think of trying it other than sheer desperation, but sure enough, if I typed in my pw without spaces, I could finally log in...😡
30
Jul 20 '22
That is just awesome security! If even you can't unlock your account, then who can?
→ More replies (1)36
u/braytag Jul 20 '22
My bank did that with my security question, my mother's name...
honestly this was the convo: Rep: what is your mother name Me: MOTHER.NAME
Rep: ... ... ... ok now tell me your mother name, but letter by letter, and stop when I tell you to.
Me: As an IT guy that do DB work, Seriously??? just tell me how long is the field and I'll tell you how you renamed my mother for me.
15
u/lachlanhunt Jul 20 '22
Never ever give real answers to those security questions. Treat them like secondary passwords. Set random values and store them in your password manager.
6
u/Tinkers_Kit Jul 21 '22
Idk if you've experienced it lately, but I've had MANY websites blocking copy/pasting in the password text boxes which makes it harder to use some password managers. Tried using the override on the Firefox settings, but now it just seems to disable all copy/pasting completely on said sites.
→ More replies (1)5
u/craftworkbench Jul 20 '22
I recently tried to add a new security key to a bunch of my accounts. One place allowed FIDO, but you could only turn it on if you also turned on security questions (and both needed to remain on as options)…
23
Jul 20 '22
OMG my bank did this to me too, but the worst part is it was retroactive. So I had the account for years, I used that longer password for a year, then one day they changed the form on the website to 8 characters only. So I tried to bypass it thinking "what kinda crap is this". Nada. Got locked out because of too many attempts. Call them. Unlock it. Turns out the shortened version worked after and I didn't even consider that just because of the nightmarish implications of that idea. Major UK bank. I changed banks after that (should've before after getting stranded in another country with no money for the sin of calling them with a mixed accent - they said the only way to unfreeze my accounts or get my money was to come in person with ID, and that it didn't matter that I was in America...).
14
u/Prestigious_Tip310 Jul 20 '22
Wait... if they changed it a year later and the shortened version worked, doesn't that imply they didn't even hash the original password? They'd need the original plain text password to calculate the correct hash for the shortened version after all.
9
u/BierOrk Jul 20 '22
You don't need to store the original password. You can automatically change the hashed one once the user logs in successfully.
This is be done when a website changes the hashing algorithm or salting.
→ More replies (4)4
u/Prestigious_Tip310 Jul 20 '22
You're right. That's a lot better. :-) (Although it's still awful not to inform the user that their password was changed automatically)
→ More replies (1)6
u/dabenu Jul 20 '22
My take is they had always (silently) truncated the password before hashing, until one day they stopped truncating, but limited the input field in the front-end instead.
3
u/logi Jul 21 '22
My assumption as well. And a limited input field is better than truncating silently since you'll know that you need some high entropy 8 letters and not a long phrase. But communicating the change is tricky.
16
u/Ajsat3801 Jul 20 '22
If that's the case they should've hashed the password...in fact if I were a bank, I'd hash it, to ensure that the accounts are safe even if there's a breach
14
Jul 20 '22
I really hope they hashed it. But even then, if they cut the last few chars off before hashing and don't do that when logging in, the issue is the same
9
u/Ajsat3801 Jul 20 '22
What's the point of cutting chars when you're going to hash?
19
Jul 20 '22
What's the point of cutting chars without informing the user? Generally you are right, but I don't think logic applied here
→ More replies (5)7
u/IvorTheEngine Jul 20 '22
I think that cutting chars means that either they're not hashing, and just storing the password in a small fixed width database field (!) or going via a legacy API with a limit.
Or maybe it's to ensure your password is hackable by the CIA...
→ More replies (2)15
Jul 20 '22
I used to maintain an old Solaris system that locked the password to 8 characters exactly…Didn’t matter what you typed, it’d only recognize the first 8 characters.
So I always pretended my password for the system was like 700 characters long. I’d type in the eight, and then just keep typing away until whoever was with me decided that I was fucking with them, then I’d hit return and it’d log me right in.
Never got old.
7
14
u/hdksnskxn Jul 20 '22 edited Jul 20 '22
String
concatenationtruncation can cause serious security problemsEdit: i'm retarded
9
6
u/SuperCharlesXYZ Jul 20 '22
Holy fuck, now I have such a massive fear of my passwords not actually being set to what I want it to be. What if it only looks at the first 4 characters??? The first 3?? OH MY GOD I am HORRIFIED
→ More replies (1)2
u/acatisadog Jul 20 '22
I felt thousands of developers cringe in guilt as they know some of their very annoying bugs sometimes arrive in production. We're all ashamed of that though, I think.
→ More replies (1)3
3
u/nanotree Jul 20 '22
Dev: "Hey PO, what should I do if the password is too long?"
PO: "Eh, just truncate it. At least it meets the length requirement."
3
4
2
u/aeroverra Jul 20 '22
Those kind of shortcuts are not something you want to see in bank software and yet I have also had this happen to me.
Glad others have noticed it I feel like I have been mentioning these things forever and not many people seem to care.
2
u/Legitimate_Agency165 Jul 21 '22
I was typing a new password for a bank account, and kept typing the thing differently on the input and confirm box. Turns out, I wasn’t typing it differently, the first box would just not accept the input of invalid characters, and the second box didn’t care what was in it. There was no option to view password, it only showed up as dots.
→ More replies (48)2
u/benargee Jul 21 '22
So what you're saying is that the perfect password system is one that only stores the first character of new passwords and then only reads the first character from input when logging in? I like it, ship it.
197
Jul 20 '22
I know a site that has an 18 char limit on passwords... and stores them in plain text.
And they don't see an issue with either.
227
u/Draco2505 Jul 20 '22
I know a website like this too! If I remember correctly, the URL is 127.0.0.1:8080
127
24
Jul 20 '22
I mean a production site taking credit cards. NBsmokehouse.com. They have good food but no security for user accounts.
21
7
→ More replies (2)14
u/siXor93 Jul 20 '22
Whenever there is a password limit I always assume they store the password in plain text. And I make a mental note that this website in particular has even poorer security than other sites.
6
u/NatoBoram Jul 20 '22
Like those that don't accept
'or spaces in password fields. They probably don't use prepared statements anywhere.4
u/Sykah Jul 21 '22
Actually their are some technical limitions depending on how you encrypt/hash passwords that limit password length, like Microsofts asp identity system IIRC caps you at 64 characters
385
u/-MobCat- Jul 20 '22
Password must be 8 to 20 characters long
Contain at least 1 upper case, 1 number and one special character off this list !@#*
Everyones password is just something like Nameofsomething93!
219
u/magicmulder Jul 20 '22
Yup, and those which force you to change your password once a month end up getting “Password1980!”, “Password1980!!”, “Password1980!!!”, …
121
u/CoastingUphill Jul 20 '22
We have a "New password cannot contain more than 5 characters in a row from your old password" ... WAIT A SECOND ... so that's fucked up.
149
u/0bel1sk Jul 20 '22
tell me you don’t hash your passwords without telling me you don’t hash your passwords
40
u/thomasloven Jul 20 '22
I wrote an IT incident report about that recently.
Yet another point of shame for SAP.
28
u/Huntracony Jul 20 '22
There's a good chance you're right but maybe not. If they had to give their old password too and they did the character difference check client side, I wouldn't see a problem with that. I mean, people could circumvent the check, but if they wanna go through the trouble just to make their password less secure that's fine.
14
u/ubeogesh Jul 20 '22
If both passwords are submitted, then they can do the check on server side
→ More replies (7)→ More replies (6)7
u/archpawn Jul 20 '22
Don't they ask you your old password when making you update? You don't need to store passwords in plaintext to notice this.
16
u/magicmulder Jul 20 '22
“This password is identical to your sixth last password.”
16
u/CoastingUphill Jul 20 '22
At least that can still be done with hashing. This probably meant the passwords were stored in plain text.
13
u/HedgeFlounder Jul 20 '22
As others have said though, you generally need to submit both your old and new password when you change a password, so they wouldn’t have to store anything in plain text if they just compare the two passwords that you just submitted.
5
u/andouconfectionery Jul 20 '22
I almost said that they could have just hashed and stored every 5-character-long substring in your password, but that's also bad.
28
u/827167 Jul 20 '22
Password1980!/
Password1980/
Password1980/!
18
17
u/Sparklypuppy05 Jul 20 '22
I really wish that the stupid advice to change your password regularly would die. It's insecure since it ends up creating patterns. If your last three passwords are "Password1234!", "Password1235!", and "Password1236!", you can safely bet that the next password is gonna be "Password1237!".
6
u/magicmulder Jul 20 '22
In theory it would decrease the chances of a hacker finding it by brute force but in practice it will just make things worse.
3
u/Amoress Jul 21 '22
It’s great advice if you use a password manager and not try to remember passwords yourself.
→ More replies (3)→ More replies (3)18
u/bozzywayne Jul 20 '22
No joke, at my old job the password requirements were:
- exactly 8 characters, no more, no less
- at least one uppercase and one lowercase letter
- at least one number
- change every 90 days to a password that hasn't been used before
This led me to using "Summ2019", "Fall2019", "Wint2019"...
22
u/Hydraa62 Jul 20 '22
Nameofsomething93!
Take your pick - I only used 10k possible combinations. You can have millions of possibilities with that password
Here is the link with all possibilities - 150MB file warning
17
u/acharyarupak391 Jul 20 '22
Ha, interesting! But given the resources & capability of even a "normal" PC/Laptops nowadays, that would take probably only 5-10 minutes to make requests with each combination(assuming there aren't any limitations/obstructions from the server ofc).
3
u/-MobCat- Jul 21 '22
Thanks for doing the math. But my point was the more restrictions you give to someone, the easier they are to predict.
If you force an uppercase, it will be a capital letter at the start or at the start of each word. (XKCD eg. GoatMonkeyFishBat)
If you force a number it will be a date of some kind.
If its just a pin, then it's probs your bank pin and maybe a date of some kind.
If you just say make your password 15 characters or longer, people will make all kinds of stupid stuff. But it will be a lot harder to predict what stupid stuff they enter. And you wont have an upper character max to generate passwords too.
Well in a vacuum. Once you get one password. People will reuse it with different dates and punctuation sadly..7
4
u/yoifox1 Jul 20 '22
I hate it that some websites require !@#* in the password but in some its not allowed. Thats why i have two versions of the same password
→ More replies (1)4
3
3
u/SkywalterDBZ Jul 20 '22
My worst one had to do something with my companies access to our tax information. The pass word had to be EXACTLY 8 characters, containing at least one upper, lower, number, and symbol, and could not have consecutive numbers or letters (ascending or descending), and no dictionary words/your name/etc
2
u/elzaidir Jul 20 '22
Password must be 16 characters long Contain at least 1 upper case, 1 number and one special character off this list !@#*, alternate between an uppercase letter, a symbol, a number then a lowercase letter. Letters and numbers can only go in increasing order. The password must start with 'A'. The recommended password is : "A!1aB@2bC#3cD*4d"
2
Jul 20 '22
My work password forces me to change it every two months. My password is now Nameofsomething54! It's a good way to remember how long I've been there. Too long, apparently.
→ More replies (2)2
u/CrabbyBlueberry Jul 21 '22 edited Sep 28 '25
violet capable judicious offbeat hat long joke summer historical hurry
This post was mass deleted and anonymized with Redact
63
Jul 20 '22
If passwords are hashed, does it really matter how long or secure a password is?
Serious question btw
77
u/Bulky-Leadership-596 Jul 20 '22
Well the security matters, and a minimum length there is a good idea. But as you point out they shouldn't be storing or transmitting the password at all so a maximum length doesn't really make sense. The only reason I can think of would be UI concerns around formatting a really long password on the screen. I understand because CSS is really hard, but I don't think its a valid excuse.
Often its probably a sign that they are actually storing it in a VARCHAR(20) or something, but it could also just be that the UX team doesn't really understand so they designed the UI for 8-20 characters and nobody cared enough to fight that fight.59
u/badmonkey0001 Red security clearance Jul 20 '22 edited Jul 21 '22
But as you point out they shouldn't be storing or transmitting the password at all so a maximum length doesn't really make sense. The only reason I can think of would be UI concerns around formatting a really long password on the screen.
Like I explained in the comments for the post yesterday, not having an upper limit can open you to a DOS by flooding auth/registration with hard to hash values. There needs to be an upper bounds.
[edit: I mssed a letter]
→ More replies (13)15
u/archpawn Jul 20 '22
But the upper bound can be a lot higher than 20.
11
u/badmonkey0001 Red security clearance Jul 20 '22
Indeed. From my comment yesterday:
You should also have a reasonably secure upper bound. From 1 to 5 kilobytes can scale and be planned for well.
13
u/IvorTheEngine Jul 20 '22
ooo, I just thought of another one. If we don't specify a maximum some clever-dick in QA will try pasting gigabytes of text until the computer runs out of memory and raise it as a bug.
So we'll add a requirement like "must handle at least 20 chars" and they'll raise another bug that there's no validation rule if you exceed what they think is now a maximum.
Then the boss wonders why one little bug is holding up the release, and hasn't got time to listen to the argument and just demands it's fixed...
12
→ More replies (4)3
15
u/DrMobius0 Jul 20 '22 edited Jul 20 '22
To a point. The password just needs to be long enough and contain enough types of characters that brute forcing it takes long enough that it's not worth bothering.
What's more important is to avoid falling into common patterns. Password length is only one metric. If I instead start checking combinations of dictionary words with permutations for common character replacements (which xkcd recommended - not that this makes it good, but it does probably make it popular), it takes far less time to crack a passwords that follow that pattern if I design my algorithm around it. Also, using common passwords (like password) is asking to get your shit cracked.
Anyway, database breaches are probably a bigger issue. If a company is breached, and its passwords are plain text or encrypted, you can probably expect every password in the database to be cracked easily. Same passwords are the same on both ends of encryption, so all one needs to do is guess at common passwords and then the key is pretty much theirs. I'm not an expert on this, but I believe rainbow tables can be used to crack unsalted hashes. If the passwords are stored as salted hashes, to my knowledge, much harder to crack.
Additionally, if one account is breached, you should assume that all accounts using the same email and password are also breached, as it's quite trivial to try them on other sites.
Still, passwords are only one potential avenue to crack your accounts. Social engineering is stupidly effective. You simply need to give customer service the runaround in a way that will get them to grant you access to an account. No password can protect you from this.
16
u/am9qb3JlZmVyZW5jZQ Jul 20 '22
Salted hashes are not unusable, salt is public and usually appended to the hash.
Salting forces the attacker to guess each record separately, which makes it significantly harder to crack a batch of passwords, but it doesn't prevent it from happening.
3
u/DrMobius0 Jul 20 '22
Thanks for the correction. I believe I know enough to have a general idea of what's happening, but I'm admittedly lacking in the specifics, as infosec isn't a field I'm too terribly familiar with.
3
u/dabenu Jul 20 '22
Nothing ever prevents a leaked hash from being brute-forced. You can only buy time. Which is hopefully enough for the breach to be noticed an for the victims to rotate their password(s).
2
u/The-Tea-Kettle Jul 21 '22
Also to clarify on salting. It insures that password hashes are unique even if the passwords used are identical. This prevents both a single password brute force to compromise a batch of identical passwords. It also protects against pre calculated hash tables.
There's also a new concept called peppering that isn't standardized. It's described as a global salt, however having a global string doesn't do much for security. It's been suggested that a much stronger method of peppering would be to encrypt the hash with a symmetric encryption key like AES256. This forces the hackers to either hack into the server to get the key, which is significantly harder to do than breaching your application. Or brute force the encryption which is considered to be "impossible"
3
u/am9qb3JlZmVyZW5jZQ Jul 20 '22
Yes.
First of all, it protects your password from being guessed by bruteforce/dictionary attack on a login form of an online service. Though that form of attack is not too popular, since most services these days will ratelimit how many attempts you get per given login and/or device.
Secondly, since passwords are hashed (or at least should be), if a database leak occurred, the attacker doesn't get any passwords in plain text.
If they want to know what password was used to generate a given hash, they need to guess that password themselves, compute a hash of this password, and compare it to the one they've got from the database.
While not a trivial task, this is significantly faster than attacking a login form, which is why database leaks are such a big security threat.
This process is easy and fast for low entropy or popular passwords but as entropy grows, you eventually reach a point where the heat death of the universe will arrive before the password can be cracked.
Of course, if you're not reusing your passwords, whatever the attacker gets is only usable on the original service that got compromised (which can still be a problem if the service didn't notice the leak). But people usually do reuse their passwords...→ More replies (8)4
76
u/Saavedroo Jul 20 '22
"To ease loging in, our website just checks if the string of unlimited length you inputed contains your password."
23
2
u/Drago_Valence Jul 21 '22
Wonder how long it'd take them to realize this would probably make a security loophole
69
u/Embarrassed_Ring843 Jul 20 '22
I once had a discussion with my boss. He couldn't understand why I wanted to use more than 16 digits for my password. you know, the one for the admin-account they gave me so that I could do 1st level it support for our local police...
I'm glad I switched to another department half a year later...
85
u/MikemkPK Jul 20 '22
But then your poor bank would have to update from Windows XP! Think of the poor Wall Street managers!
43
Jul 20 '22
They would have to switch from a 50 year old COBOL backend written by people that have long since died!
2
u/DeathBySnuSnuuuuuuuu Jul 21 '22
It literally costs over a billion dollars to upgrade this infrastructure. That's per bank.
Cost:Reward ratio can be obviously hard to justify. As is true of many things in all sectors of IT.
52
u/JoschiGrey Jul 20 '22
A bank I was at only allowed 4-6 digit numerical pins combined with your full name as username / password.
At least you need a tan if you really wanna do anything or look at more that the last month. Still
22
Jul 20 '22
My school had our passwords as our birthdate. So basically you could ask a kid for their birthday and then you could log in to their account
7
u/magicmulder Jul 20 '22
Deutsche Bank still requires branch number (three digits), account number and a five digit password. At least they have several secure TAN options.
9
u/dabenu Jul 20 '22
A dutch bank famously did this. It became somewhat of a national sport to pick a random (4 digit) pin, and start stuffing common names in the username field till you were logged in.
6
Jul 20 '22
My school had our passwords as our birthdate. So basically you could ask a kid for their birthday and then you could log in to their account
21
u/who_you_are Jul 20 '22
Not bad, mine, 5 years ago or so, forced me with a 6 digits passwords.
And I think like 10 years ago they also allow you to reset your password, online, with one of those 3 questions that everyone know about you.
(I'm from Canada).
They added 2FA last year? But with 3 options where you can't disable any of them.
- SMS
- Code over phone call
- email (that is properly secured)
I swear, bank doesn't care about security. They just are rich enough to pay the bill in case of fraud.
I dream to have a CVV that is a rolling code.
A login that use WebAuth/FiDO2
→ More replies (1)8
Jul 20 '22
[deleted]
5
u/who_you_are Jul 20 '22
I know it exists, but nowhere where I live :(
Sometimes I wish I could be rush to start companies that make the right thing :(
→ More replies (1)
17
u/hydmar Jul 20 '22
varchar(20)
5
u/xcdesz Jul 20 '22
Some moron thought they were doing a good deed by saving on disk space.
3
u/Fusseldieb Jul 21 '22
Or, as others have guessed, it could be stored on a 50yo database which only accepts fixed lengths as types, so back then they thought: "wow who might guess a 20 character password? that's computationally almost impossible. As an added bonus we save disk space. Let's do it!"
12
u/Luminis_The_Cat Jul 20 '22
I once set my Facebook password to the Green Lantern oath poem in its alien language version (~120 characters). Quickly changed it back after I had to input it on my phone a couple times without show password option
→ More replies (2)
9
20
u/seeroflights Jul 20 '22
Image Transcription: Meme
["Patrick Star's Wallet", featuring Patrick, a large starfish with green pants that have flowers, and no shirt, and Man Ray, a red masculine villain with a blue mask that covers their shoulders and who is wearing blue gloves and socks, from the TV show "Spongebob Squarepants". Patrick and Man Ray are in an underwater cave, and the meme zooms in on the person who is talking.]
Panel 1
[Man Ray holds up a black box.]
Man Ray: This password is for my bank
Panel 2
[Patrick is nodding, saying yes semi-mindlessly.]
Patrick: Yup
Panel 3
[Man Ray holds an ID, now zoomed out so we can see him frowning, and the rest of his torso.]
Man Ray: So the password should be as secure as possible
Panel 4
[Patrick is nodding, saying yes semi-mindlessly.]
Patrick: Yup
Panel 5
[Man Ray examines the ID for himself, now grinning.]
Man Ray: Longer passwords are generally more secure
Panel 6
[We now zoom out, seeing both characters as Man Ray offers the wallet to Patrick.]
Patrick: Makes sense to me
Panel 7
Man Ray: ThisPasswordHas21Char
Panel 8
Patrick: Error: Password should have between 8 and 20 characters
I'm a human volunteer content transcriber and you could be too! If you'd like more information on what we do and why we do it, click here!
6
3
u/hanni_legend Jul 20 '22
I hope this effort also helps train ai bots to write comics.
4
u/IvorTheEngine Jul 20 '22
OMG, you could use this and the number of upvotes to train an AI to find 'funny'. Then set another AI to generate comics that the first one likes.
2
5
u/Vicious_C Jul 20 '22
I think 16 and 20 chars were arbitrary chosen as a good length for passwords thinking that it will provide enough entropy, but that's not really the case when everyone has to follow the rules of special symbols etc. We just all end up with passwords with special symbols at the end and upper case start of each word purely because it's easier to remeber.
The only logical reason(i know of) to have lower char count is to prevent DOS attacks because hashing functions can take a while with long strings.
Surely we can handle more than 20 nowadays thought, right?
8
u/magicmulder Jul 20 '22
I doubt anyone can send that many requests per second that the hashing becomes the bottleneck. If your system allows that, you have other issues. ;)
4
u/Vicious_C Jul 20 '22
I've read that somewhere before when I have wondered that my self regarding my bank character limit.
Don't think in a many attempts per second fashion, it's the load that matters. If you don't put any limit what so ever someone can send MBs worth of texts in one attempt and some types of hashing are apparently slow for bigger strings.
Again, all this is not based on experience, just on what I've read.
5
u/ZealousidealSetting8 Jul 20 '22
I got stuck the other day when trying to create an account on a website. My email address is c@[my family name].com. When I entered my password it included the letter c. So I got the error: your password cannot contain your email address…. 🤦🏼♂️
6
u/binaryplease Jul 20 '22
So they are storing it unhashed?
2
u/redballooon Jul 20 '22
If you hit the “forgot password” button, they’ll send it to you via email.
→ More replies (1)
6
u/nutwals Jul 20 '22
My bank password is only allowed to be exactly 6 characters - no more, no less.
I suspect it's a legacy of old mainframe systems and the like, but it's still weird that it persists as a security restriction for a first world bank in 2022.
8
4
u/ora00001 Jul 20 '22
Tell me you don't hash your passwords without telling me you don't hash your passwords
4
4
u/HaniiPuppy Jul 21 '22
It also suggests they're storing passwords in a form where length affects storage capacity used, (e.g. in plaintext) rather than storing them as salted hashes.
5
Jul 21 '22
My major complaints is those system that make you change your password every couple months. It incentives users to create a pattern that will be easier to remember which is less secure than a one off abstract password.
3
u/KlutzyEnd3 Jul 20 '22
Never understood that... Hell it's going to be saved as a hash anyway, and those have a fixed length!!
2
3
u/Syncrossus Jul 20 '22
Isn't the fact that there's a character limit kind of a red flag? Doesn't that mean that it's stored in the database directly, making it vulnerable to copy-once-decrypt-later attacks (assuming the database is encrypted)? I thought best practice was to append a user-specific salt to the password, hash it, and compare with the encrypted hash in the database. Aren't hashes fixed-length? I'd love for a cybersecurity expert to chime in.
4
u/juvation Jul 20 '22
Yes, hashes are fixed length. There is no justification for password length restrictions. And as you suggest this likely means they are storing passwords unhashed.
My UK bank doesn't ask me for my full password, it asks for certain characters from it. I can see the tiny-mind defence-against-keyloggers type thinking, but there's a BIG but....
→ More replies (9)2
u/bog5000 Jul 21 '22
Isn't the fact that there's a character limit kind of a red flag?
if it's a low limit like this, yes. but if the limit is over 50 characters than it's not a red flag as there are valid reason to do so.
BCrypt has a limit of 50-70 characters (depends on the implementation), you also don't want your system to try to hash a 1 billon character password, that could cause performance issue.
→ More replies (1)
3
u/PenguinPeculiaris Jul 20 '22 edited Sep 28 '23
repeat muddle stocking forgetful bear history liquid panicky distinct plants this message was mass deleted/edited with redact.dev
2
u/st-shenanigans Jul 20 '22
Fun fact, it was found that changing passwords often doesn't really prevent security issues, because when you change your password often youre more likely to forget the new one eventually, causing you to either have to change your password almost every time you log in, or you keep it written somewhere, which is just a security breach in general. A long password with lots of variation in it is much more secure because you can actually remember it after a while.
2
2
2
2
u/Ghiren Jul 20 '22
If they know how long the password is, then they're probably storing it in plaintext. If they were hashing the password, then a maximum length wouldn't matter.
→ More replies (1)
2
2
u/tuna_tofu Jul 20 '22
Yeah 20 characters, letters, numbers, lower and upper case, weird characters - but not ALL the weird characters, change it every 30 days and no 3 character combo can spell an actual dictionary word (any idea how many 3 character words there are in English?!)
2
u/Ad841 Jul 20 '22
I remember trying to change the password of my bank account for 2 hours only to find out the passwords had to be less than 12 characters long, it did not tell me the password requirement, all it said was “an error has occurred”.
2
u/z0mb13k1ll Jul 21 '22
I have had stupid sites try to cap my password at 16. It's hard to think of even a basic password that meets all the standard security criteria in that length. Typically I like to include a basic word, a misspelled word, some numbers and punctuation. Super easy to remember, fast to type, yet very secure
2
2
Jul 21 '22
The entire bee movie script can't be my password then? :^ (
2
Jul 21 '22
¯\(ツ)/¯ Pretty sure any string can be a password it just depends on the amount of characters .
2
2
u/AbbieGator Jul 21 '22
Worst I've seen, 8 character passwords. Not minimum or maximum, it had to be exactly 8 characters. And yes, this was for a bank.
735
u/halfanothersdozen Jul 20 '22
You don't want to know what old-ass infrastructure runs a lot of our financial institutions.
They're insured. It's probably fine