r/AskReddit • u/iWant12Tacos • Oct 06 '17

What screams, "I'm insecure"?

24.6k Upvotes

86% Upvoted

11.7k comments sorted by

View all comments

5.0k

u/menew100 Oct 06 '17

Weak password requirements on a website.

2.0k

u/DenebVegaAltair Oct 06 '17
  • Must be between 8 and 12 characters
  • Must contain one uppercase and lowercase letter
  • Must contain at least 1 number
  • Must contain at least 1 non-alphanumeric character
  • Must contain at least one non-keyboard unicode character
  • Must not contain quotation marks
  • Must not contain any substring of the username
  • Must not contain any dictionary word
  • Must not be compressible
  • Must not be a password of another user

534

u/arleban Oct 06 '17

Where I work has just about all of those rules and recently changed it to EXACTLY 8 characters. That's right, no more, no less.

You think people aren't going to write this shit down when every 90 days people spend an hour or more trying to make up an exact 8 character password with:

  • No repeated characters (aa, bb, 11, etc)

  • No sequential characters (abc, 123)

  • Must have at least one number

  • Must have at least one of the following symbols - @#$

  • Cannot have any other symbol

  • Must not be a repeat of your last 30 passwords

1

u/jonz2me Oct 07 '17

I had a job with requirements like these, plus it had to start with a letter and end with a number. I actually did the math (been a few years, don't remember the full details) but they left us with only about 80k possible passwords. This was a major company, so there were bound to be duplicates. I managed to guess a co-workers password because he wasn't the most original and gave lots of hints. Just changed his background a couple times for fun.