Cybersecurity - Memes

1964 readers

2 users here now

Only the hottest memes in Cybersecurity

founded 1 year ago

MODERATORS

[email protected]

565

Obscure password requirements (feddit.org)

submitted 2 months ago by [email protected] to c/[email protected]

107 comments fedilink hide all child comments

What is your favourite password rule?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 11 points 2 months ago (1 children)

Maximum length is the biggest red flag to me and was the catalyst for me making the effort to switch to unique passwords per-account years ago. There's just so, so many shitty homerolled security systems out there... and data breaches seem to be a perennial problem these days.

There's just no excuse for limiting the length if you're doing security correctly (other than perhaps a large upper limit just to protect against someone DOSing the backend with a bunch of 100MB strings; 512 characters seems reasonable).

By setting an upper limit, you're basically saying one or more of these things:

We store your password in plaintext
We store a hash but our hashing function has an unnecessarily arbitrarily limited input size
The person/team implementing the backend has no idea what they're doing and/or just copy pasted login code from stack overflow
We tried to get away with minimal password requirements but some middle manager wouldn't rubber stamp it without arbitrary_list_of_bs

[–] [email protected] 5 points 2 months ago

My senior project for uni was replacing the professor's friend's website. We had a meeting to gather requirements, have him demo the site as different kinds of users, etc. Dude said "Hold on a sec" and went to a page with all accounts and their passwords listed. Was like, dude, the hell