Hacker News Reader

Comment by slantyyz | Hacker News Reader

Just as bad - the ones that enforce an uppercase, lowercase, number and special character. Except that they don't tell you that when they mean "special character", they don't mean all of them, and don't tell you which ones are invalid.

I can't tell you how many times my 1Password generated password was disallowed because of a special character that I ultimately had to delete by trial and error.

View on HN

If you think that's bad, my water utility (Severn Trent Water), at the time, accepted a password of arbitrary length, but only processed 20 bytes of it at login time.

This means when I created my account with a 63-character password, which it let me do, and then I logged in for the first time, literally minutes later, with the same 63-character password, it told me it was invalid. Of course, at the time, it didn't tell you what the length limit was, and the login and signup forms didn't limit it either. If I didn't have the bright idea (and prior experience elsewhere) to try "maybe it's only the first n characters of the password", starting at 8, and finally succeeding on 20 (thanks to no rate limiting), I would have never figured it out.

One time I used a system that, when setting my password, it converted all letters to lower case, but it didn't do the same when trying to log in. I figured out that's what happened when I called them and they told me to give them the password over the phone (yep) and then started giving me hints about what was 'wrong' with the password I gave them. This was a financial services company.

www.flashseats.com does this as well... let's you type in a long password, but only saves a small portion of it.

Another fun variant on this is where you're allowed to set a password with special characters that the password validation code later rejects.

Reply on news.ycombinator.com