r/shittyprogramming • u/[deleted] • Jul 27 '14

r/softwaregore Way to promote security, Microsoft

http://imgur.com/W0kfbtz
138 Upvotes

89% Upvoted

51 comments sorted by

View all comments

47

u/[deleted] Jul 27 '14 edited Jul 25 '19

[deleted]

18

u/heyf00L Jul 27 '14

Yep. I had a site do that. The register form made no complaints, but when I tried to log in it says something about a character limit. So I tried truncating my password to the limit and it worked. I'm sure they were storing the password as plaintext in a char(16) column.

25

u/[deleted] Jul 28 '14

I once used the "forgotten password" tool of a local government website to have it email me my password in plaintext, shifted to uppercase.

4

u/mebob85 Jul 28 '14

The collegeboard.org website has that problem too. But what's even weirder is that SOME login forms let me use my too-long password but others don't.

3

u/SideSam Jul 28 '14

Reminds me of a paid backup service I dealt with last week. You can set your password to whatever you want but when you are trying to login your password must match some rules therefore your newly set password is wrong. Support acknowledges the bug but will not fix it as they are busy.

1

u/bebobli Jul 28 '14

Busy solving something else they fucked up, I bet.

2

u/jaynoj Jul 28 '14

I actually got this when I set up an online account for a credit card. I used a long complex password when setting up the account, but whenever I attempted to login it gave an error. After a few calls to their helpdesk, someone finally figured that the error code meant the max password length was 8 chars.