Nothing infuriates me more than when they ask me to reduce my 20 char alphanumeric+symbols unique password to a 4 char numeric pin for my security.
My (soon to be ex) bank recently decided to make everyone use their ID card number which can be obtained from many sources and does not change, a username with symbols and numbers and minimal length requirements which cannot be changed and a 4 digit pin code. No 2FA at all, so its only saving grace is that you get locked out at 3 tries.
I’m guessing they are trying to align everything to their legacy ATM pin code system instead of making the ATM system better.
There is something about ATM system architecture that must be so ancient it ran on punch cards. In reality I’m sure it’s COBOL being COBOL but there’s hardly any excuse for a machine to take SO LONG to process a simple transaction.
Credit unions really are refreshing (as much as a financial institution can be, at least). Mine’s utter shit, but they’ve still gone to unrestricted length ATM pins and options for 2FA / 3FA online access and they support FIDO2 for auth & transaction confirmation. It’s ridiculous how behind the establishment banks are getting.
It’s also a gigantic red flag when sites say there’s a password limit
Bitch, my password is supposed to be hashed so even if I uploaded the LOTR trilogy extended edition in 4K, it should still come out the same length as any other SHA256 hash
I have 5-6 apps I log into for work that all have different password requirements and are on different expiration periods. One of them is so crazy that I have to take 3-4 spins on a password generator before I get one it will accept. We also don’t have a password manager that’s approved to install. So, the result of all this is that I store my passwords in onenote. Very secure. Great job everyone. At least for the less severe ones I can just put whatever number I’m tagging on the end of the usual password I use.
We had a system at one of my old companies that with each password change, you couldn’t have any of the same characters that were in your last password (12 character max so it was never impossible to solve), you couldn’t have the same character in the same place as any of your last 10 passwords, or the same character type (letter or number) in the same space as the last password. Also no special characters.
The end result was everyone ended up using a1a1a1a1 for the first password, then 2b2b2b2b, c3c3c3c3, 4d4d4d4d, etc. The draconian password requirements resulted in everyone using the same passwords.
You know some turd in the IT department was so proud of themselves for coming up with that too.
And of course they have to be storing the passwords in plain text somewhere to maintain that history.
At work my main password has to be changed every two weeks and has insane requirements and we can only use some shit company approved password manager which I cant even install on a rooted phone. This has resulted me in just changing 1 digit every 2 weeks, 10/10 guys!
I have to do it every 3 months. I’m at [password]27! now.
hunter3
This password has been seen 37,384 times before in data breaches!
Holy shit, I didn’t expect people to really use it, even with a changed digit.
https://haveibeenpwned.com/PasswordsWhy did you post 7 asterisks?
Your password must be at least 10 characters long.
ERROR: INVALID PASSWORD ENTERED!!!
PASSWORD MUST NOT EXCEED 12 CHARACTERS!
Even better when it doesn’t tell you and just drops the last characters.
I still stand by xkcd 936.
Since no one can know which characters you used, you have to assume all/most. Throw one character in there to be safe, in the middle of a word.
Banks on the other hand: no you’re only allowed 4 numbers!
Let me introduce you to MyP4s$worcl*websitename**@
I assumed it was password1! Yours is better
Do you want your password to be sent raw into a service to analyze your password entropy and detect common patterns, OR do you want a simple rule which can be checked client side?
You don’t send full raw hashes, k-anonymity is a thing. HaveIBeenPwned just takes the first 5 of a hash and sends you back a list that you compare clientside so it never leaves as a usable password.
Analyze password entropy client-side. https://dropbox.tech/security/zxcvbn-realistic-password-strength-estimation
My new job has us doing various security trainings every month and they also send out fake phishing emails. I initially ignored the emails prompting me to do the training because they require you to click a personalized link in the email to access the training. Eventually, my manager reached out and asked why I hadn’t done the training, so I explained, but finally clicked through to do it. That month’s training was about how a long passphrase is more secure than a list of character type requirements. Guess whose password requirements are a list of character type requirements?
