SSA Password Requirements are terrifying

imgur.com

Not case sensitive? so they lower case / upper case it all? or store as plain text?

I have no idea what they're doing on the back end but this is bad. They do "randomize" your username. It looks like it's also limited to 8 characters and since they sent it in all upper case, my guess is that's what they're doing.

On the bright side, my password does expire in July!

hey if you forget your password at least you can brute force it in less than an hour :)

Exactly 8 characters A-Z not case sensitive and numbers 0-9.

Was verifying a contractor's SSN for my company. This is not remotely good IMO.

Even better doesn't encrypt/hash the personal reset questions answers. What color was your first car? Lmfao.

> What color was your first car?

Why, it was b5142147-5720-421e-885e-aa032de362aa, of course.

Yeah, I use nonsensical and offensive strings like: YourMothersD1rtyPu55yColored

Lol, well not that exactly, but you get the idea O|-) </Cylon Angel>

Reply on news.ycombinator.com