This is a rant about dumb password policies enforced by some websites or apps. If you see these password rules forced to you, try to stay away if possible.

Can’t use special characters, or use a pre-defined special characters only

Are you storing the password in plaintext that your database will break when have special characters?

Password can’t be longer than X characters

Most probably storing the password in plaintext and their database column is limited to those characters limit.

Password expire every X months, without notice, suddenly can’t login. Reset it and can’t use the last 5 passwords

They store your previous passwords, either encrypted or plaintext.

  • dual_sport_dork 🐧🗡️@lemmy.world
    link
    fedilink
    English
    arrow-up
    21
    ·
    1 year ago

    “Cannot use a sequence of characters used in any previous password,” or “Cannot use a previous password backwards.” Those are sure fire indicators that they’re storing your passwords in plain text.

    I used to have a bank that had the first rule. Emphasis: Used to.

    And putting an upperbound length limit on passwords is pants-on-head loony, unless the length limit is very large, like 1024 characters or something. Especially if it’s going to be hashed anyway.

    • KHTangent@lemmy.world
      link
      fedilink
      English
      arrow-up
      8
      arrow-down
      1
      ·
      1 year ago

      Some password hashing functions have a maximum input length. That could be a reason for some of the requirements. E.g. if I remember correctly, bcrypt used a maximum of 60 characters, while still being an ok choice for a hashing function

    • zockersanftmut@feddit.de
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      1 year ago

      My bank has a rule that your password needs to be exactly 5 characters. It’s completely nonsensical. Thankfully, a few years ago they at least implemented two factor authentication so there’s some safety. Otherwise I would probably change to a different bank.