Re:The Correct Way to Validate Email Addresses
by Freak_NL on Thursday September 08, 2016 @04:08AM
(#12451140)
> Anything any password generator spits out, so long as it meets the min length criteria, should be accepted
It annoys me to no end when I have to hand-craft a password to stay within the silly rules of some service.
Be vocal about this! Keep complaining to the services you use that don't accept such valid passwords. Banks for example are notorious in insisting on short passwords and arcane limits on which characters to use (ING in the Netherlands limits you to 20 characters, and nobody there seems to be able to explain why).
Re:The Correct Way to Validate Email Addresses
by garaetjjte on Thursday September 08, 2016 @04:49AM
(#12451307)
With banks there is other problem, because they often use partial passwords. They are password manager unfriendly and often limited to 16 characters.
Re:The Correct Way to Validate Email Addresses
by erelde on Thursday September 08, 2016 @05:20AM
(#12451457)
Société Générale uses the client ID and a 6 digit passnumber (sent via physical mail) with a digital numpad (you have to click) where each number is randomly placed.
So secure.
And they force a change every 3 months. As if a new 6 digit pass was more secure than the last 6 digit pass.
There is no reason to assume rejecting of a + means they don't hash, and browsers escape the password for you in POST/GET etc. The fact that + is used for space really isn't relevant.
(That said, I think it's pretty stupid to "validate" passwords beyond checking for "12345", "password", a min length, and other public info. e.g. your password should not be your name or date of birth. Anything any password generator spits out, so long as it meets the min length criteria, should be accepted).