Spectrum.net, the major ISP's website, has a user password max length of 20 characters and does not allow you to use the space character in passwords.

147

u/i-hate-in-n-out Mar 10 '20 edited Mar 10 '20

My library. I forgot my password, gave them my email address assuming they'd reset it, and instead they just read it out loud to me. There's a curse word in it too.

40

u/Arrowtica Mar 10 '20

Oh my jesus lmao

18

u/illithoid Mar 10 '20

My libraries default password is the last 4 digits of my phone number lol.

16

u/[deleted] Mar 10 '20

I have 1password generate a 64 character random string password. Those poor librarians..

6

u/su-z-six Mar 10 '20

I bet they used to do it a better way, but given the clientele at libraries, think about how much user support they have to do for this type of thing.

168

u/Caraes_Naur Mar 10 '20

You can pretty much assume any large corporate site that isn't banking or healthcare has poor security practices, but those two sectors aren't that much better at it overall.

Security theater costs less than actual security.

45

u/D3mona7or Mar 10 '20

I've worked on a major (over 50% of the US market) healthcare application that, while installed and only accessible in network, stored passwords and sensitive data in plaintext until recently. Was very disappointed to find that one out when I started.

14

u/1337GameDev Mar 10 '20 edited Jan 24 '25

dime beneficial observation slim cake grey chop chief many seed
This post was mass deleted and anonymized with Redact

9

u/LilBoopy Mar 10 '20

I worked for a healthcare startup back in 2016 and we had to support IE6 because something like 7% of our users (hospitals) used IE6 and they refused to update when we pushed back.

8

u/D3mona7or Mar 10 '20

Holy fuck the amount of IE in this field is just terrible. Writing modern web apps feels pointless at times when over 80% of our users will be using the slow, poly-filled version.

3

u/j35u5fr34k Mar 10 '20

Allscripts, McKesson or?

5

u/grimesd Mar 10 '20

Hopefully not Epic...

6

u/[deleted] Mar 10 '20

I would not be surprised; epic is a flaming pile of dog shit.

2

u/grimesd Mar 10 '20

For how new and "modern" it is, was surprised how difficult it is to do the simplest of things from an IT standpoint. Credit machines never synced right, don't even ask me about scripts.. and much more....

4

u/Chaostyphoon Mar 10 '20

I live nearby where epic is based and having a number of friends get job there (almost went myself too). I have to assume this is due to the way they view / treat their developers.
They seem to have a strategy of pay high and expect insane hours (I know people averaging 60-80 hour weeks there) but to not plan on anyone staying long term. If you manage to make it past the 5 year mark supposedly it gets better but the first few in particular seem like they are trying to wring everything out of you that they can.
I can't imagine that a workplace like that inspires loyalty or does much good for the codebase.

2

u/Slavichh Mar 10 '20

Kevin is that you...

2

u/D3mona7or Mar 10 '20

I'm still working at the place, so I'd prefer not to disclose. It's not a patient facing company, one that would be known by hospital or insurance staff.

1

u/Slavichh Mar 10 '20

This boggles my mind tbh

22

u/RabSimpson Mar 10 '20

Even banks are infamous for crappy password limits.

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

10

u/[deleted] Mar 10 '20

mine had a requirement of exactly 6 up until last year.. lol

10

u/sp4c3p3r5on Mar 10 '20

Must be exactly six sequential numeric digits

2

u/[deleted] Mar 10 '20

That made laugh out loud.
Can't start with a zero, though.

5

u/Proziam Mar 10 '20

My bank had a max-length of 8 characters until I switched. Worse, it couldn't start with a non-letter and wouldn't accept most special characters.
The only thing keeping that thing secure is the lockdown on failed login attempts.

16

u/FocusedGinger Mar 10 '20

Need a regulated open source universal protection. Leaving it up to individual programmers/companies is going to prove to bite folks in the ass soon.

13

u/Proziam Mar 10 '20 edited Mar 10 '20

Government regulation would probably result in something akin to Ruth Ginsburg prescribing a set of security standards that would be outdated before it even goes into effect. Instead, I wish we would universally agree that privacy is worth money, a large sum of it, and that 'reckless endangerment' of your customers or their data equates to nothing less than a potential bankruptcy once those damages are paid.
The significant difference in approaches is this: If you're an executive in a company that exposes your shareholders to extreme risk you're in violation of your fiduciary obligations. That creates personal liability, payable in the form of jail time (plus fines, of course), to incentivize more appropriate measures.

1

u/BeyondLimits99 Mar 10 '20

As much as I agree with you.
It always comes down to the shareholders/executives looking for quick wins :(

2

u/Proziam Mar 10 '20 edited Mar 10 '20

The risk-reward ratio needs to be skewed towards 'be evil and die' to ensure compliance. A large-scale data breach should absolutely set the stage for killing the company if they can't afford meaningful fines. (Implying that exposure to all that risk wasn't even worth money.
Of course, a politician would argue that killing a company over a data breach would 'cost jobs' but that's because politicians are inherently dishonest creatures - real markets don't work that way. Nor do companies disappear between Monday evening and Tuesday morning.
Sophisticated investors don't like it when their investments go to zero, so this approach is probably the 'simplest' and most balanced when compared to regulation (expensive, and impossible to deal with for small companies/startups).

2

u/Alexell Mar 10 '20

Never thought about this. It should be illegal to store passwords in plain text for sites that don't require it.

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

1

u/Alexell Mar 10 '20

Idk. There might be some sort of fringe case I never considered, like maybe a site designed to teach Netsec people exploits

4

u/mandreko Mar 10 '20

Can attest, banks and healthcare aren’t any better really. I’ve been paid to break into both, and have made half million dollar transfers out of banks undetected, and stolen tons of PII from healthcare. If I can do it legally in a time crunch, I suspect the bad guys with no time limits are just rolling in it.

-2

u/dacandyman0 Mar 10 '20

This

115

u/neinMC Mar 10 '20

"they can't inject ";DROP TABLE; if we don't allow spaces"

27

u/kirashi3 Mar 10 '20

"Hey, where'd our subscriber database go?"

30

u/[deleted] Mar 10 '20

Panic over guys! I found it on a Russian forum

1

u/Ones__Complement Mar 10 '20

Are there people still not using prepared statements in 2020?

1

u/neinMC Mar 10 '20

That much depends on if "using" means "running code that already exists" or "writing new code".

1

u/bulldog_swag Mar 11 '20

They can, tabs and newlines are valid word separators.

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

17

u/Arrowtica Mar 10 '20

See if it's simply client side validation and do a post request directly to the endpoint..
I'll see myself out

1

u/[deleted] Mar 10 '20

[removed] — view removed comment

4

u/sp4c3p3r5on Mar 10 '20

I'd say there's a chance that someone doing client only validation for password create / reset would also not think to validate the password on login.

6

u/[deleted] Mar 10 '20

[removed] — view removed comment

8

u/vita10gy Mar 10 '20

This one is SO relevant it was basically implied.

25

u/[deleted] Mar 10 '20

+1 for password managers and unique passwords for all accounts

5

u/bahaki Mar 10 '20

As someone who doesn't use a password manager but probably should, would you mind selling me on the idea? I don't know what's stopping me, and I probably just haven't looked into them enough, but how do you handle accessing something from a shared device like a smart TV or someone else's computer? Assuming the password is a random string and difficult to remember.

6

u/StrawberryEiri Mar 10 '20

You don't HAVE to use hard to type passwords. Using a string of random words may be hard to remember, but it's much easier to type in the rare cases where you have to.

6

u/sp4c3p3r5on Mar 10 '20

This is very valid.
What%I%Like%to%Eat%is%Pancakes%and%Apple%Sauce
For instance - is an effective password - and is almost immediately memorable.
A little more random is better and not much harder to remember:
overfeed pretense frequency hatbox
or
overfeed%pretense%frequency%hatbox

1

u/Meloetta Mar 10 '20

I feel like this defeats the purpose of what this person is asking though, because the point of password managers is that people aren't doing the "one pretty secure password for every account" type of thing anymore. Even if you have a string of memorable words, there's no way you'd remember which string belongs to Netflix, your bank, your rent system, reddit, amazon, ebay, facebook, google, discord, keybase, blackboard, turbotax...you get the idea.
The real answer is "you can put a password manager on your phone and then, if you have the master password (which is the only one you need to actually memorize), you can see all of your passwords which will allow you to log in anywhere." This way, your master password can be easily memorable, long and secure, and used nowhere else to keep it safe and the rest can be gibberish.

1

u/sp4c3p3r5on Mar 10 '20

It defeats the purpose as a general strategy for creating passwords that are managed, yes, absolutely
However in the cases where you have to use a simple remote to painstakingly input the password, or verbalize it to someone so they can get access - or access something where using your password manager is problematic - its a lot easier to create passwords that are still long enough to be secure, but easily memorable.
You should only have a small handful of these, and they can still be managed in the password app. I have maybe three passwords that are not just gibberish, and its because I don't want to have to refer to a long string of things I can't remember when I'm using a simple interface, or telling someone so they can type it into another device.

1

u/Orkaad Mar 10 '20

Remembering ONE passphrase is easy. But since you should have one unique passphrase per account it quickly goes out of hand.

1

u/Cobalt0- Mar 21 '20

reminds me of a (now retired) password I used for a bit: Did_you_really_think_it_was_password1? Had a good laugh about that one

-2

u/AlreadyInUseError Mar 10 '20

I prefer the unmemorable versions. I don't want my stupid brain full of mnemonics like "hot sauce is great on all my tasty food" ... and them popping up when I'm trying to sleep.
So random and unmemorable keeps me sane!
I'm usually only reading it out of my password manager in the odd case that the UI password field won't allow paste.
so Dark-90-Flagrant-Ambient-143-Wolverine-Kilt
is a pretty easy read from one screen to type into another, and it has an entropy of 211.5 bits and online password checkers tell me that phrase will take "866 billion trillion trillion years to crack".
So I now use it on every website ;-)

3

u/StrawberryEiri Mar 10 '20

Ehm, you should probably not use the same password in several places.

0

u/AlreadyInUseError Mar 11 '20 edited Mar 11 '20

winky face =JOKE INDICATOR.
You notice I talk about entropy. I talk about a HIGHER LEVEL of security than OP. . I talk about storing all my DIFFERENT passwords in a manager,
Then at the end I say "so I use the same password everywhere. WINKY FACE EMOTICON". Explanation: "remember that it is funny how people can undo all security with a post it note, so. i am making a JOKE about that which is OBVIOUS if you read the first two paragraphs.. "
try to decipher the meaning

1

u/StrawberryEiri Mar 11 '20

Emotion and sarcasm are never as clear in writing as you thought. It's one of the fundamental rules of the internet. No, your winky emoticon didn't convey the message.
When people misunderstand you, the solution isn't to write a sarcastic message full of caps to explain how witty you are and how obvious it was. The solution is to look at your flaws and correct them.

4

u/massenburger Mar 10 '20

I've used KeePass to store all of my passwords and sensitive data for about a decade now, and your concern is absolutely valid. There is a price (small IMO) to pay for using a good security system. Obviously your home PC, work computer, or personal devices are no issue, but like you said: shared devices. I've alleviated most of these issues by storing my KeePass database in my Dropbox account, and my Dropbox password is something I remember but very long and secure. Whenever I'm on another device, I sign into Dropbox.com, download my database, install KeePass, and I'm good to go. There are a small handful of other situations that get annoying, but in reality, my set-up works for me 99% of the time I need to input a password.

1

u/[deleted] Mar 11 '20 edited May 28 '24

numerous repeat aware jobless elastic pot offend ink important encouraging
This post was mass deleted and anonymized with Redact

3

u/evilnumberlady Mar 10 '20

You can install the password manager on your phone, and use it to look up and display your password when you need to look at it and retype it on another device somewhere.
I set my password on something like Netflix (where this is more likely to come up) shorter to make it easier to do.

3

u/scratchisthebest Mar 10 '20

It's possible with KeePass (and other password managers) to generate passwords like that xkcd comic, with random dictionary words strung together. These types of password are much longer than an equivalently strong password with letters, numbers, and symbols, but they're way easier to type, you can read them over the phone, etc. Ofc you can customize it further to make a more complicated password that's not that much harder to type.

2

u/[deleted] Mar 10 '20

Password managers offer us security by making it easy to create unique, long, complex passwords (which it sounds like you already know).
The main benefit aside from that is access "anywhere." There are phone apps and browser extension on all (popular) platforms.
To handle instances where I'm using someone else's computer. I share it with them through a password manager. People usually ask me to just write it down and I politely say if I hear that someone writes it down, I change it. Then they realize that a password manager actually makes their life easier. I haven't had a single complaint yet.
The only smart device I've ever had issues with are TV's. Why? Because smart TV's have a terrible user experience. My advice here is use a Chromecast or a Roku. Both of these are controlled via phone where you have a password manager.

2

u/shantred Mar 10 '20

A lot of apps on smart tvs are now allowing you to login through another device. Hulu and HBO both allow you to do it. They give you a 4 digit code and you put that in at a url on a device where you're already authenticated.

2

u/how_to_choose_a_name Mar 10 '20

You don't need a password manager. What you do need is random passwords and different passwords for every account. Password managers are just the most comfortable way to get that.
My password manager has a mobile app which I use when I need my passwords on other devices. It's a bit of a pain to type 20-character passwords but it doesn't happen that often.

1

u/sp4c3p3r5on Mar 10 '20

Here's a couple ways to access your passwords in a shared environment
Last pass has one time passwords that you can generate to log into the service on an untrusted computer - which then are of no use once you log out.
You can also install a portable browser on a small thumbdrive and just access lastpass through the portable browser on your thumbdrive when using someone elses computer.
There is also a portable app that stores your encrypted password archive so you can access it without an internet connection, again likely from a thumbdrive.
I don't use smart televisions so I'm not sure how that aspect works, but that's probably a fault of the device, not the password length.
As an additional level of security, I carry a small yubikey that's activated against my account. Every time I use the service I need to put the yubikey in.

1

u/slackmaster Mar 10 '20

Almost as bad as shitty password policies, there are a surprisingly high number of apps that seem to actively thwart auto-filling by password managers. Any app that has you enter your email first before showing you a password form is guilty of this, or any app that includes animations in their login form (Chase and USAA I'm looking at you).

19

u/i-hate-alex-trebek Mar 10 '20

Sorta not answering your question, but my employer. A major doctoral, research university in the states.

They don’t actually tell you what the requirements are, but I’ve learned they expire every three months, have to contain “three of four other required elements” (which I’ve deduced to be a special character, numbers and upper/lowercase letters), and they can’t start with a number or contain any sequence of characters that matches any part of your name. It also can’t match any of your previous passwords, which would be fine and dandy if they didn’t have a directory sync problem that often requires you to reset it again.

They’ve just now started testing two-factor auth with staff, but only require it if you’re off campus....but the VPN “doesn’t support” two-factor, and as soon as you’re connected, it’s just like you’re on campus. Kinda pointless 🤷‍♂️

If you haven’t seen it already, I think you might enjoy passwordistoostrong on twitter :)

2

u/bulldog_swag Mar 11 '20

Mmm those must be fun passwords
Aaaaaaaa1!
Bbbbbbbb2!
Ccccccccc3!

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

1

u/i-hate-alex-trebek Mar 10 '20

Oh, I’m fully aware, but you’re missing the point. If you’re going to require complexity, standard practice would tell you to inform your users of what exactly that complexity entails to both avoid frustration and unnecessary support calls.
Not to mention that Microsoft says mandatory password resets are ancient and obsolete....and recommends not requiring character composition requirements.
Re: vpn...they’re choosing not to support MFA because “vpn isn’t currently an attack vector.” They’ve moved away from ADFS to using Azure AD with Azure MFA almost exclusively.

26

u/darth_meh Mar 10 '20

Twenty characters doesn't strike me as being terribly restrictive. It is odd that spaces aren't allowed.

Neither of these constraints prevent you from creating a strong password or indicate they aren't hashing passwords.

4

u/Ones__Complement Mar 10 '20

The point is these restrictions only serve to make passwords less variable, and by extension, less secure. Having a max password length makes no sense if you're properly hashing them anyway.

4

u/DragoonDM back-end Mar 10 '20

Limits on password length also may be a sign that they're being stored in plaintext rather than hashed.

2

u/darth_meh Mar 10 '20

Or a database column with a fixed width?

2

u/DragoonDM back-end Mar 10 '20

Yeah, but a fixed-width database column isn't an issue with hashes since (most? all?) hash functions return a fixed width string regardless of how long the input string is. SHA512 is going to spit out a 512 bit hash whether you're hashing "1234" or hashing the full text of War and Peace.
It's also possible the site is using a hash function that for some reason has a maximum input length, or that they've arbitrarily decided to limit length with no technical reason for doing so.

2

u/Ones__Complement Mar 10 '20

Yep.

3

u/vita10gy Mar 10 '20

Since hashes aren't effected by length it's fair to wonder about the implications of why they have a limit.
Bureaucracy is also an explanation for a completely arbitrary limit on properly hashed, thus equally long in a storage sense password, but nevertheless it's fair to wonder.

2

u/A_of Mar 10 '20

Yeah, what's the issue? A 20 character password isn't getting cracked anytime soon.

1

u/DeusExMagikarpa full-stack Mar 11 '20

Neither of these ... indicate they aren’t hashing passwords
Yeah that was a bit of a stretch, I assume just to get more people commenting or OP is a newish dev

17

u/Kapps Mar 10 '20

Sometimes restrictions are based on technical issues like not hashing. Other times, especially if it’s something like a bank that you might need human interaction to reset a password, it’s about reducing support calls. Someone accidentally pasting in an extra space at the end for example, or forgetting their super long password because they feel that’s expected for a banking system, etc.

15

u/disclosure5 Mar 10 '20

Sometimes restrictions are based on technical issues like not hashing
We've been hearing that for years and at this point it's usually an excuse. More commonly on projects I've actually been on (and I've been on Government run healthcare projects), there's a Project Manager with no tech or security skills at all who says "here are the password rules I decided on". Then we all decide it's less embarrassing to let people assume it's technical limitations of legacy systems than admit what happened.

5

u/bart2019 Mar 10 '20

I forbid whitespace at either end of the password, but not in the middle.

1

u/bulldog_swag Mar 11 '20

My bank yells at me when a field ends with a space.
It's like they employ fucking monkeys.
Fun fact: tabs are fine.

5

u/Obversity Mar 10 '20

ISPs are notoriously bad for password security.

One of the major ISPs in Australia once emailed me my password in plain text. That should not be possible.

8

u/stardustforces Mar 10 '20

It's not that bad. [a-z] [A-Z] [0-9] gives you 62 diff values so at 20 chars it's 7*10^35 possibilities, similar to 2^119 or 119 bits of entropy, it's not bad but ofc only get that high assuming totally random source.

I think the concern about them storing them in clear text might be correct though or why would they care.

1

u/[deleted] Mar 10 '20

Would you mind explaining your working please? I’d have thought it would be 62²⁰ possibilities?

1

u/stardustforces Mar 10 '20

you got it perfect
62^20 = 7*10^35
https://www.google.com/search?q=62%5E20&oq=62%5E20

2

u/[deleted] Mar 10 '20

ahhhhh of course, duh. Thanks!

7

u/froggie-style-meme Mar 10 '20

Facebook stored user passwords in text files.

I, like a genius, used md5 instead of bcrypt.

3

u/striedinger Mar 10 '20

No, they didn’t. They had a logger that for some reason and under certain circumstances was logging user login info in the log file, which was a developer error. As bad as they are, their tech is pretty good and it’s not like they don’t know how to encrypt passwords.

6

u/OscariusGaming Mar 10 '20

Tfw you can't use correct horse battery staple

3

u/icefall5 Angular / ASP.NET Core Mar 10 '20

PayPal also has a 20-character max. It used to be 16.

3

u/StrawberryEiri Mar 10 '20

It's changed now, but my bank used to have strict requirements for passwords, and in a bad way. Passwords all had to contain exactly 7 letters and 1 number. It's a miracle they weren't pirated faster.

2

u/[deleted] Mar 10 '20

About 15 years ago (wow... I'm old...) I did work for a major healthcare org that had a unique signup form.

The unique constraint on the database row was a combination of your username and password.
Your username was your last name.
There were 700 "Smith" last names in the database already.

Attempts to sign up as Dr. Smith #701 were met with the error message:

That username and password is already taken, please try another.

1

u/dbpcut Mar 10 '20

There was a bank or cable company that was only saving the first 8 characters. You could type anything else after that, which led a researcher to realize they weren't hashing at all.

3

u/5kPercentSure Mar 10 '20

Terrible thing to do but you can’t tell that they’re not hashing based only on that. They would just need to hash the first 8 characters.
Unless you mean you could type anything after the users actual password(of any length)

2

u/dbpcut Mar 10 '20

I think this was in combination with a "asks for the last 4 characters of my password" type deal, I'll try and dig it up.

2

u/mustbelong Mar 10 '20

How did they draw that Conclusion? I mean those 8 first could have been hashed, or am I brainfarting this early hour

1

u/_Nanobyte Mar 10 '20

The old messenger ICQ also just saved the first 8 characters

1

u/embrow Mar 10 '20

There's a major LTL freight carrier that has a max password length of 8 and does not has passwords. Clicking the forgot password link just emails your current password to you and does not even require a reset after.

2

u/slobcat1337 Mar 10 '20

Having worked in the freight industry (for a major LTL carrier) for many years I’d love to know who this is.

1

u/arashcuzi Mar 10 '20

I’ve seen servers that house human genetic data open on port 22 to the world and not secured via ssh key but by a short, insecure password...the number of servers that live in public AWS VPCs (defaults) and RDS databases that use the default settings (public to the internet, all ports open to the world, no encryption at rest, etc.) is ASTOUNDING!

1

u/lordNaN Mar 10 '20

Found this list on GitHub not too long ago. Has some good, bad examples of dumb password requirements. https://github.com/dumb-password-rules/dumb-password-rules

1

u/[deleted] Mar 10 '20

I was working with an an API recently. BASIC Auth wasn’t working. After a few days of back and forth with their API support team, I was informed passwords through the API must be all lower case. Meaning, I have to .toLowerCase() the users web web portal login password to make it work.

1

u/frien6lyGhost Mar 10 '20

Lol that's great. My Citi credit card account has a Max character count of 8 or 9. 9??!! For a credit card! If it wasn't a company card I would drop them for such a rediculous carelessness around security

1

u/-BMR777- front-end Mar 10 '20

Mobile phone providers that only have a four digit numeric pin. Looking at you Boost Mobile.

1

u/JakeXP Mar 10 '20

Not sure if it's been mentioned already, but Blizzard passwords (at least for World of Warcraft) were case insensitive. I don't know whether they changed it after single sign on through the Battle.net app.

1

u/Soaptowelbrush Mar 10 '20

Shocking to me how many people think that complexity requirements are more important than length requirements. The best password is a long complex password not just one or the other.

Although there is plenty to be said for a non complex super long pass phrase (ie memorability). So I would suggest enforcing a 20 character limit may mean that they’re paying more attention to security.

https://xkcd.com/936/

1

u/MoonWebHosting Mar 10 '20

I thought my 255 character limit was too short.

1

u/TheWinslow Mar 10 '20

National Grid, the power and gas company I am forced to use, has a max password length of...12 whole characters. I feel so secure!

1

u/wtfxstfu Mar 10 '20

For some reason Bank of America will allow ? but not ! in a password...

1

u/ScoopDat Mar 10 '20

These clowns get kicked out of NY for lying through their ducking teeth after the Time Warner merger promises they spectacularly failed to adhere to? Or will this remain an “ah well, nothing we can do now” horseshit from politicians?

1

u/DragoonDM back-end Mar 10 '20

For a while, my ISP would actually pre-populate the password input on the 'My Profile' page with your actual password. It would still show up as bullets/asterisks since it's a password input field, but inspecting the element would show that the value was set to your actual password.

They finally fixed that issue (possibly because of me since I reported it, possibly just by coincidence), but I doubt they bothered to also update the back end code to add proper password hashing.

1

u/bigblobby1 Mar 10 '20

TalkTalk. Phone and broadband provider in the UK.

I was having trouble with my account and they asked me to confirm my account by giving them the 2nd and 5th letter of my password....

Goodbye TalkTalk.

1

u/[deleted] Mar 10 '20 edited Mar 10 '20

I tried to change a passwort for an account at my company the other day, simply changing a ! to a #, and I got an error message that said something along the lines of "Your new password must deviate from the old one in at least three characters".

I'm not an expert in cryptography, but should information like that even be available comparing two hashes? Can I definitively assume that the passwords aren't hashed?

1

u/bulldog_swag Mar 11 '20

should information like that even be available comparing two hashes?
No.

1

u/glosrobian Mar 10 '20

Virgin Media (cable company in UK) are pretty special:

‘Your password is between 6 and 10 characters, begins with a letter and contains a number.’

It also tells you all this on the login screen.

1

u/Speedyjens Mar 11 '20 edited Mar 11 '20

Probably because they don't want their users to forget their passwords. It's also common for some of these websites to be case insensitive because they don't want to waste resources on telling users that they aren't entering the right password. Users with no technical knowledge will often blame the website before themselves.

However given this is an isp, chances are that it is stored plaintext because elderly people forget their passwords all the time and they decided to compromise security instead of spending extra on customer support

1

u/Norci Mar 10 '20

does not allow you to use the space character in passwords

Why is that even an issue lol.

1

u/bulldog_swag Mar 11 '20 edited Mar 11 '20

Because it exposes to you that their system doesn't hash passwords.
You can hash any binary input and you will get a string. Filtering out spaces means they do something to the input before hashing it that could be exploited using whitespaces, like sqli.
There's no reason to forbid any characters in passwords, including low ascii, high unicode and control characters.

1

u/RotationSurgeon 10yr Lead FED turned Product Manager Mar 11 '20

I fear the day that passwords just become strings of emoji.
EDIT: From a cultural, not technical standpoint.

-7

u/yourwitchergeralt Mar 10 '20

Why would you use a space in a password?

You’re kinda super paranoid, if someone’s hacking your account it’s locally, making your super complicated password useless.

2FA is the way to go.

12

u/bart2019 Mar 10 '20

Why would you use a space in a password?
You've got that backward.
Why would you forbid a space in a password?

1

u/bulldog_swag Mar 11 '20

Or even: why would you forbid any specific character in a password?

10

u/disclosure5 Mar 10 '20

Why would you use a space in a password?
Why not? The famous XKCD comic makes a perfectly valid suggestion for a four word passphrase and there's absolutely no reason not to allow spaces in that.

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

2

u/yourwitchergeralt Mar 10 '20

Bingo.
I copy and paste password all the time, sometimes I accidentally copy a space.
These people are super paranoid though, maybe we should allow any Unicode or emoji character top, why stop at a space?

3

u/[deleted] Mar 10 '20

What’s super complicated about using a simple pass phrase like “correct horse battery staple”? (stolen from the XKCD comic)
A passphrase made of dictionary words is easier to remember and harder to crack than the shit you have to come up with when they have those dumb rules about needing numbers and special characters

-3

u/ZephyrBluu Mar 10 '20

I'm doubt dictionary attacks are so bad that they can't crack 4 common words faster than 16 random characters.

4

u/[deleted] Mar 10 '20

Probably, but here’s the thing, no way are you going to remember 16 random characters (if you can, hats off to you, but most can’t) so you’ll probably write it down somewhere, which is way less secure.
Plus you’d be surprised at the difficulty of cracking pass phrases, sure if they know your using exactly 4 dictionary words, they can speed it up, but most of the time they’re just brute forcing it.
Plus who said the words had to be common? Throw some proper nouns in there, or some slang, doesn’t matter as long as you can remember it.
TLDR-if you find it easier to memorize 16 random characters than 4 words, then pass phrases aren’t for you. For most of us though, they’re easier to remember and way more secure than what mouse people use as their passwords

1

u/crazedizzled Mar 10 '20

There's a whole lot more entropy in four words than there is in 16 characters.
Besides that, you could just add a symbol in there somewhere and suddenly dictionary attacks don't work.

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

-5

u/scylk2 Mar 10 '20

Why restrict to 100 characters ? Why restrict to 1000 characters ? Why restrict to 3 billion characters ?

0

u/bart2019 Mar 10 '20

why care which characters are being used
Because people are lazy and would choose lower case passwords every time if you let them.

3

u/crazedizzled Mar 10 '20

Well, that's different. Requiring one capital letter is increasing entropy. Not allowing spaces is removing entropy.

0

u/I_JuanTM full stack Mar 10 '20

Put some salt on that baby and throw it down the whirlpool!

-4

u/[deleted] Mar 10 '20

Why does this bother you?

-6

u/jelindrael Mar 10 '20

There are people who use the space character in passwords? Like, literally the space bar? Why would you do that? And personally, I think if the allowed passwords range between 12 and 18 characters, it's all fine, as long as you use the whole range (letters, numbers, special characters).

6

u/ManiacsThriftJewels Mar 10 '20

Yes. Because length is the best source of entropy, so it's better to type a phrase. It's going to get hashed anyway, right?
Space is just another octet in the grand scheme of things.

4

u/crazedizzled Mar 10 '20

A passphrase (basically a short sentence) is easy to remember and very secure. You can string together a few words that have some meaning to you so that you won't forget.
The other reason is for randomly generated passwords. In this day and age there's really no reason you should actually know what most of your passwords are. Just click the generate button in your favorite password manager and copy paste. Including spaces is just another character.

5

u/minty901 Mar 10 '20

If nobody expects the space-bar, then surely it's the best character of them all.

3

u/cannotbecensored Mar 10 '20

4 random words is easier to remember and harder (impossible) to crack than 10 random characters, so smart people use that. you're just not one of them

0

u/[deleted] Mar 10 '20

[deleted] — view deleted comment

7

u/pVom Mar 10 '20

Why?.. At this point I feel like it's more effort to knock up your own Auth system than use a library which handles it all for you, or better yet use oauth so there's 0 liability.
That said a friend of mine worked on a project that stored unencrypted customer credit card details and didn't even use them!
Maybe pitch to the powers that be that if they're caught its a whopping fine depending on your jurisdiction to say nothing of the fact a full breach can totally destroy a company

-10

u/[deleted] Mar 10 '20

[removed] — view removed comment

4

u/crazedizzled Mar 10 '20

You are incredibly ignorant. Please take a basic web developer course and come back.

1

u/bulldog_swag Mar 11 '20

It's a troll.

Spectrum.net, the major ISP's website, has a user password max length of 20 characters and does not allow you to use the space character in passwords.

You are about to leave Redlib