Etrade lets you create 32 character password, but if you enable 2FA you suddenly can't login because apparently they concatenate them together and then check the length. So make sure your password is max 26 characters. (they might've fixed this but I haven't tried).
Re:Complexities of e-mail validation logic
by sbierwagen on Monday May 24, 2021 @02:45PM
(#27268153)
Like GP mentioned, Etrade also does the thing where it accepts the . character on password creation, but not login. That was fun to figure out.
Re:Complexities of e-mail validation logic
by hsbauauvhabzb on Monday May 24, 2021 @05:14PM
(#27269794)
Curious, can you login with 26 characters and your MFA seed to bypass MFA entirely?
Yup! Same thing with the ridiculous verify-my-identify questions. One I encounter all the time is the local community college, which let me use spaces in my answers on creation, but not at entry time. Grrrr.
Re:Complexities of e-mail validation logic
by zxcvbn4038 on Tuesday May 25, 2021 @07:10AM
(#27275384)
That happens too often! A lot of places where I try to use a really long password will silently truncate it, but different forms will truncate at different lengths, so what might work for registration might not work for login or changing the password later.
I’m always suspicious when sites cap passwords at < 32 characters, that almost always means it’s being stored in a reversesble format someplace - maybe encrypted, maybe obfuscated, or maybe not either (banks).
The sites I really trust don’t care how long your password is because their hash size is fixed. The only real length consideration might be that if a bunch of people send obnoxiously long passwords at the same time and they are using bcryprt or scrypt it might stress the server’s cpu, so they might put an upper limit to prevent that.
I ran into this with Sony's PlayStation site. I generated a passphrase that the registration form allowed but from then on I was unable to access my account. I went through the same trial as you and found that they were truncating the password to something like 16 characters. That was just this past year, so I'm pretty sure it's still that way.
As a user, I got burned by that several times. Now, when I create a new account somewhere, the first thing I do is log out and try to log back in.
I don't encounter this very often myself. So far the only place I've seen this is Paypal. facepalm
Sometimes disabling Javascript will fix it, sometimes not. I occasionally have resort to using "I forgot my password" until I figure out what the actual underlying requirements of the passwords are.