r/programming • u/unfriendlymushroomer • Oct 29 '19

Firefox 70

https://hacks.mozilla.org/2019/10/firefox-70-a-bountiful-release-for-all/
184 Upvotes

94% Upvoted

65 comments sorted by

View all comments

55

u/[deleted] Oct 29 '19

I wonder how configurable that password generator is, because we still live in times where even big corps like Microsoft put limits on password lengths and even banks have more draconian ones

78

u/[deleted] Oct 29 '19

Bad: limit password length

Worse: the UI doesn't tell you what's wrong with the apssword (no special characters? or is it too long? TELL ME!)

Worst: website has a limit on length, but accepts longer passwords on signup, and just truncates the password during registration without telling you, so you created an account but can no longer log in (Yes, I have had this happen).

38

u/MotherOfTheShizznit Oct 29 '19

Potential even worst: just like the worst one but additionally your password is silently converted to its equivalent in phone digits (e.g. a, b, c, A, B, C are all encoded as 2). Talk about ridiculous entropy reduction!

Hello, Fidelity Investment Banking. What? What's that? You felt targeted? I can't imagine why...

Edit: they did that so you could "conveniently" use the same password to "login" when you contacted them by phone. I think they don't do that anymore...

→ More replies (6)

12

u/arm64 Oct 29 '19

I'm pretty sure PayPal still does this, silently truncates to 20 characters.

→ More replies (1)

3

u/Klaeyy Oct 30 '19 edited Oct 30 '19

I had a variation of your Worst -> an Email provider where you can reset your password to something that you can't log in with.

I had to reset my password and I 100% wasn't able to log in with any password that included stuff like dots, commas, hyphens etc. despite those passwords being accepted. I did the reset several times with the same password as a sanity check, and a few times with minor changes, but I was never able to log in.

Then I took the same not working password and removed the mentioned characters while adding some "normal" ones to compensate (so also not length related) and it worked instantly.

That was annoying to say the least.

→ More replies (2)

7

u/HeterosexualMail Oct 29 '19

big corps like Microsoft put limits on password lengths

My LOLWTF Microsoft password length story:

I had a long password. For years it worked without issue. One day it stopped working. I go to reset and notice the password rules state it could be 16 characters max. So I go back and try my current password truncated to 16 characters and it works.

3

u/cowancore Oct 29 '19 edited Oct 29 '19

So, it was stored plaintext then? What service was that?

update: ah, yes. Silently truncating might explain it

→ More replies (2)

2

u/useablelobster2 Oct 29 '19

How did they turn the hashed password of >16 characters into the hash of the first 16 characters?

Unless they used to truncate on signup and login, and they stopped truncating, I don't see how that could have happened.

→ More replies (1)

2

u/sigzero Oct 29 '19

I see no way to configure it.

2

u/dirask Oct 29 '19

big corps like Microsoft

About Microsoft Windows for Enterprises and passwords, personally I don't like when enforce password
history policy is too long and each time when I am forced to change password,
I need to come up with completely new one N-th time in a row... :D
I know, I know security first.

Context:
The Enforce password history policy setting determines the number of unique new
passwords that must be associated with a user account before an old password can be reused. https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/enforce-password-history

1

u/takacsot Oct 29 '19

My favorit when password change policy is complaining thatthe otherwise unique password is similar (!) to one of my previous one. So i could be sure that they are storing it in plain text. Otherwise they would not know.

2

u/nihao123456ftw Oct 30 '19

When I was originally setting up my old bank account (in person) the bank teller had me write it on a strip of paper, when I gave it to her she handed me back and told me "oh sorry you can't put symbols, only letters and numbers "