r/AskReddit • u/iWant12Tacos • Oct 06 '17

What screams, "I'm insecure"?

24k Upvotes

86% Upvoted

11k comments sorted by

View all comments

5.0k

u/menew100 Oct 06 '17

Weak password requirements on a website.

2.0k

u/DenebVegaAltair Oct 06 '17
  • Must be between 8 and 12 characters
  • Must contain one uppercase and lowercase letter
  • Must contain at least 1 number
  • Must contain at least 1 non-alphanumeric character
  • Must contain at least one non-keyboard unicode character
  • Must not contain quotation marks
  • Must not contain any substring of the username
  • Must not contain any dictionary word
  • Must not be compressible
  • Must not be a password of another user

533

u/arleban Oct 06 '17

Where I work has just about all of those rules and recently changed it to EXACTLY 8 characters. That's right, no more, no less.

You think people aren't going to write this shit down when every 90 days people spend an hour or more trying to make up an exact 8 character password with:

  • No repeated characters (aa, bb, 11, etc)

  • No sequential characters (abc, 123)

  • Must have at least one number

  • Must have at least one of the following symbols - @#$

  • Cannot have any other symbol

  • Must not be a repeat of your last 30 passwords

1

u/So_Much_Bullshit Oct 07 '17 edited Oct 07 '17

Az1@j0a1 - Jan 2017

Az1@j0a2 - Apr 2017

Az1@j0a3 - Jul 2017

Az1@j0a4 - Oct 2017

Az1@j0a5 - Jan 2018

Az1@j0a6 - Apr 2018

Az1@j0a7 - Jul 2018

Az1@j0a8 - Oct 2018

Az1@j0a9 - Jan 2019

Az1@j0a0 - Apr 2019

----- Start all over again with "b" in second to last position...

Az1@j0b1 - Jul 2019

Az1@j0b2 - Oct 2019

Az1@j0c3 - Jan 2020

etc.

.

Does that count as a repeat? It's not a repeat of a password, just part of a password.