A compilation of websites with dumb password rules (dumbpasswordrules.com)

>Restrict the inclusion of a % character.

That's awfully specific that begs the question why it exists.

>> don't know what GitHub is or how to work with it, you can even just message me on Mastodon

lmao

IIRC a website for a train company in Japan requires exactly 8 letters as password even now. I can’t remember which though.

This is what happens when compliance rules force sites to have specific policies. Especially when you have more than one set of rule combined.

With that said, a lot of these seem pretty reasonable. The one that I really don't get that keeps appearing is max length though. I get that they may not want to allow you to have a 10MB password but I think a reasonable max like 500 characters would be better. A max length of 8 makes me think they are storing the unhashed password in a VARCHAR.

Also, from a UX perspective some of these rules may be best to only tell the user about if they actually trigger it. Like "most not contain username" is uncommon enough they can probably only show it if it actually happens. Same with "cannot reuse last 4"

> BBVA

> Username is your national ID (easy to find) and your password must have up to 6 alphanumeric characters only.

Insanity. How is a system like that remotely acceptable?

I absolutely love the concept behind the site.

I'd like to submit all the sites that disable copy/paste on their password entry, especially if they have stringent password content policy.

My randomly generated 10 word passphrase is more secure than your password policy, but I don't want to type it in by hand, you donkey.

ME Bank is the best:

- Must be all numerals.

- Be 7 to 20 digits.

- Cannot have the same number three times in a row.

- Cannot have four ascending or descending numbers.

- Cannot have the same number appear more than five times.

- Cannot have pairs next to each other if the second pair is one number higher.

- Cannot be the same as 8 previous ones.

It would be fun to work out mathematically how much they're limiting the password space with these rules. I'm also not sure what "Cannot have pairs next to each other if the second pair is one number higher"; is that referring to consecutive pairs of numbers, or pairs of consecutive numbers, e.g. 7788 vs 7889.

    from collections import Counter
    from random import randint
    def is_valid(password: str) -> bool:
        # cannot have the same number 3 times in a row
        if any(password[i] == password[i + 1] == password[i + 2] for i in range(len(password) - 2)):
            return False
        # cannot have 4 ascending numbers
        if any(all(password[i] == str(int(password[i + j]) - j) for j in range(4)) for i in range(len(password) - 3)):
            return False
        # cannot have 4 descending numbers
        if any(all(password[i] == str(int(password[i + j]) + j) for j in range(4)) for i in range(len(password) - 3)):
            return False
        # cannot have the same number appear more than 5 times
        if max(Counter(password).values()) > 5:
            return False
        # cannot have pairs next to each other if the second pair is one number higher
        if any(int(password[i:i+2]) == int(password[i+2:i+4]) - 1 for i in range(len(password) - 3)):
            return False
        return True
    total_valid = 0
    samples = 10**5
    for i in range(samples):
        password = str(randint(10**6, 10**20 - 1))
        if is_valid(password):
            total_valid += 1
    print(f"valid passwords: {total_valid}")
    print(f"valid percentage: {total_valid / samples * 100:.2f}%")

today i had to update my work password

to do so, requires 2fa push to okta

the push didnt come through

so i opted to insert the code manually

i opened the app to get the code but it was showing the push notification from before

i click yes to authorise, it gives an error and reloads back to same notification

i click back manually to try and get the code, it shows the code for a millisecond but then goes back to notification

restart app few times, no luck

i will try tomorrow again to update my password

The most absurd example is the US government TreasuryDirect[1]. No password input box to provide your password. You have to use an absurd virtual keyboard abomination. ProTip: Go into developer tools and just paste your password into the value attribute for the password form field.

[1] https://dumbpasswordrules.com/sites/treasurydirect/

Suggestion: add a rating system, because some of these are more dumb than others. Also add an indicator or separate rating for requirements that make the passwords too easy to guess like “no more than 8 characters”. e.g.

> Coil

> Does not allow simple characters and sequences such as '4587' or 'efgh' in password & necessarily requires numeric values.

or Apple’s requirement that you cannot have more than 3 consecutive characters, seem reasonable to me. Certainly these rules ban perfectly fine passwords, but they’re a lot better than something like “must be between 8 and 16 characters and contain one uppercase, lowercase, number, and special character, but not these special characters, and it also cannot have an edit distance of 3 from your user ID”

Nice, but displaying this as a gallery seems to make it harder to quickly parse all of these. The rules are all just images some hard to read at that scale, and some cut off. If you click on one, you can't page to the next, you have to go back to the gallery and click on the next.

Seems like it would be nice to have the actual set of rules next to each example, and to be able to page through the examples.

I also find having to page through the home page a little odd.

Good idea. Hope the companies listed take notes.

One of the dumbest I've seen is when the username has password-like requirements, like insisting capital letters and numbers.

“ Also, this gibberish if you intentionally left the "confirm password" field empty and that's even after a en_US redirection. 请输入新的登录密码.”

While it’s unfortunate that the particular string is not localized (it means please enter new password), this is not gibberish. Other languages are not gibberish

I've never understood the sites with weirdly short limits ... like 6 characters, bonkers.

The French Family allowance is an interesting case.

https://dumbpasswordrules.com/sites/caf-french-family-allowa...

It looks crazy but actually I think they were trying to solve an insolvable issue. The population that will want to use this website is basically anyone who has children in France. That will include some very computer-illiterate people using god knows what public devices, some of them, very likely infected with all malware known to mankind.

They came up with this: have people click on numbers whose place change all the time and whose real values (beside the image shown) are server side. They probably hoped that it would protect the users from at least basic keyloggers attacks.

In the late 90s I remember signing into my bank account and being sure I mistyped my password.

So I logged out and back in and discovered that capitalization didn’t matter… neither did the any characters after the first six characters. It was a large national US consumer bank.

I sent them an email. They actually updated their system about 3 months later.

Some of these rules make sense. For example, bcrypt (still secure enough of you pick a decent amount of iterations, though you should really be using something more modern like argon2) will take a maximum of 72 bytes. In a Java, Javascript, or native Windows based system, that could easily mean a maximum of 36 characters unless you do some risky unicode conversion (UTF-16 to UTF-8). With unicode you can spend three bytes on a character if you use the right (wrong) ones and that doesn't even touch the upper character codes that some systems can't represent. Upgrading systems to use modern hashing algorithms isn't always easy or even necessary as long as you pick your parameters well, but this does limit the input of your system.

Some special characters (èéòó etc.) will have two or three different unicode code points, and using them means the server needs to either decide to mess with your password to unify the characters or accept the binary input you've submitted and hope that your other devices will input the character in the same way.

That said, if my password can't contain emoji, I don't trust your system. I've had one important service once tell me that characters like <>&; were illegal, which makes sense... if you're planning to show the password in HTML and you don't trust your sanitizer.

I've even helped someone log into a web service that needed to have every ' or " be preceded by a \. Someone must've called mysql_real_escape_string on a password there...

Should be rule-centric rather than site thumbnail centric. I came to see dumb rules, not a bunch of thumbnails

My favourite was at one of the companies I worked for. The admin decided that users are not to be trusted to choose their own passwords and so you had to mail the admin to generate the password for you which you then could not change on your own -- you had to mail him again. The password had to be changed every month and an email would go to entire company to change passwords before the guy goes on vacation.

I would like to think we progressed a bit but recently I worked for another company which required that we use our company domain password to log in to test linux servers. The issue is that everybody has root access on those servers. I implored that it is not safe and there should be separate accounts to access those servers but of course nobody would hear it.

So I wrote a script which intercepted all logins and passwords of people logging in to our test servers and then sent to the manager responsible for it. Well... they wanted to fire me for "hacking" their servers and I had to explain to them that once you have root on a server there really is not much they can do to prevent me from stealing passwords.

The end was they did not understand anyway and I was barred from accessing test environments. They also changed the linux distribution and "hardened" it because the old one "must had security vulnerabilities".

Fortunately, I soon changed the job again.

I’m no cybersecurity analyst, but there’s a reasonable amount examples that don’t seem that out there to me.

For those who get this better than I do, what would be the ideal set of password rules?

My dumbest experience was a Japanese local paid VOD website. It only allowed FOUR ALPHANUM CHARS for password in 2018. I suspect that they want to make it easy to input with TV remote. Fortunately they relaxed limitation now.

The stupidest login I've seen to date is the US Treasury's TreasuryDirect website. You can create your account using your password manager that kicks out a secure password, but when you go to log in, you have to use a stupid virtual keyboard using your mouse, so you can't type your password in. You have to use your mouse to click buttons on a virtual keyboard.

Who sold this dumb 'solution' to the government?

edit: I see it's on their list already. Gosh, it's horrible.

Hmm... NordVPN... "Password cannot be longer than 48 characters."

I think that's an acceptable rule? The longest password I've used was 30 characters. Does anyone need longer?

https://dumbpasswordrules.com/sites/nordvpn/