[delta_p_delta_x]

Having more than just alphanumeric characters widens the domain of the password hash function, and this directly increases the difficulty of brute-force cracking. But having a such a small maximum password length is... puzzling, to say the least. I would accept passwords of up to 1 KiB in length.

With rainbow tables, even 11-character simple passwords like 'password123' can be trivially cracked, and as the number of password leaks show, not everyone is great at managing secrets and credentials.

[empyrrhicist]

It's easier for me to remember really long passphrases than even short alphanumeric strings - small maximum password lengths set my teeth on edge. The passwords should be getting hashed anyway right?

[raddan]

The problem is that you never really know what a website operator does with your credentials. Ideally, you have both a unique email and a unique password for each site, because sadly credential stuffing [1] is a thing.

[1] https://en.wikipedia.org/wiki/Credential_stuffing

[abustamam]

Should being the operative word...

[abustamam]

I recommend all my friends and family to use a password manager like Bitwarden, and if they can't do that for some reason, at least use a 3-word passphrase separated by a hyphen.

The amount of times people have complained to me that this doesn't work because of low max-chars on passwords is insane.

[empyrrhicist]

One time I had to reset my password with the power company - they had such a system, and the lady had to read me something like:

Uh4zB4DP55WD!

Apparently I was a bit salty with the system when I set it.

The fact that she shouldn't have even been able to look up the password in the first place due to hashing was lost on her.

[abustamam]

That's pretty funny on a few levels, not in the least that they required a "secure" password like that but stored them in plain text.

[raddan]

I regularly conduct transactions at the branch of my local bank wherein they ask me for no credentials whatsoever. I also once forgot to bring my account number with me and the teller said "no worries, I'll look it up for you." Kind of horrifying.

[lostlogin]

Oh! But that’s safe! Secret question time: What’s your mother’s maiden name.

[jazzyjackson]

It helps that it’s a jailable offense to make fraudulent transactions

[doubled112]

Isn’t unauthorized access to a computer system also a jailable offence in most places?

Would using the password you gain through this social engineering be doubly illegal?

[tonyedgecombe]

My bank’s password field is case insensitive. Of course they could have lowercased it before hashing but I doubt it.

[abustamam]

That's scary. I wonder if incompetence like that could lead to a lawsuit in the case of a breach.

At this point I wouldn't be surprised if there exists a system that just asks for username with a checkbox "check here if you are the owner of this account"

[empyrrhicist]

Yeah I was a bit shocked... like... you're not supposed to know that!

[tshaddox]

I bet the rationale would be "anything over 12 characters will be too hard to remember and people will just write down the password."

[empyrrhicist]

But it's a maximum. It prevents people that want to use passphrases from doing so.

[unethical_ban]

Until the late 2010s, the AD account password at my financial institution employer was capped at 12 characters because, for a subset of workers, AD creds were sync'ed to a mainframe application that could only support that many characters.

[jamesfinlayson]

Sounds about right. One of Australia's big four banks had the online banking password requirement of exactly six characters for a long time - for similar reasons I assume.

[abustamam]

I think we (whoever we is) should start normalizing the concept of passphrases; on sign-up screens they should show the benefits of a passphrase. I'm surprised that Googles PW generator does not use passphrases, and I don't know about ios because I haven't tried theirs yet.

I started using passphrases after I saw this xkcd https://xkcd.com/936/

When I'm trying to log into something on a device that has a terrible keyboard, like a TV or giant touchscreen, it's a lot easier to type words I know than gibberish.

[delta_p_delta_x]

correct horse battery staple; knew it before I clicked the link.

[abustamam]

Whoops, I've been pwnd!

https://haveibeenpwned.com/Passwords