Disabling paste anywhere is a cardinal sin.

“We want to make sure the user gets this right. So instead of letting them just hit Ctrl+V let’s make them type the whole thing, introducing all sorts of possibilities for errors!”

My favorite is when sites completely disable pasting my bank account number.

Oh, let me get out my bifocals and checkbook that I copying from... and definitely not my online banking we've had for two decades+.

I wonder, what is the rationale for this "security feature"?

Wise for example, allowed me paste the password for creating account or changing the password. Password was 20 characters long, but seems like they cut it on client side or backend to 15. So when you login, it does not cut the password, and I never could figure out why I could not login in some places.

So one dump rule creates another

Oh, and if you have a maximum password length, I don't trust you with my data.

Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration.

That one is a fun one to find out.

T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN.

Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security

HSBC UK does this.

Swiss bank Cler is guilty of this too, in a way.

At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.

You can’t just let users paste in 18,000 characters you need to limit the password length somewhere. But I agree a limit less than 255 chars is insane.

> You can’t just let users paste in 18,000 characters

Thank you for speaking up. And here it is: I don't trust you with my data.

Passwords should not be stored in a database. Period.

So how do you check a password if you can't store it? Hash it with a salt. This results in a fixed width output, regardless of the password size.

If you are setting a max password, it's because you are trying to store it as-is, which is why I don't trust you to store my data.

Edit: I also think it makes sites that do this a target security wise. It's like advertising ignorance.

TreasuryDirect.gov should get a special callout for forcing you to use an on screen keyboard to click your password, with of course paste disabled.

I'm glad you enjoy it! If you have any sites you like to add, please feel free to contribute. https://github.com/duffn/dumb-password-rules/blob/main/CONTR...