News for hackers. Stuff that matters.

A comment on Show HN: A compilation of websites with dumb password rules. Parent comment

Re:Show HN: A compilation of websites with dumb password rules by madamelic on Wednesday February 15, 2023 @09:34AM (#34804310)
Only surpassed by _having_ a password length then truncating it to fit rather than throwing an error at registration.

That one is a fun one to find out.

[ Parent | on HN ]
Re:Show HN: A compilation of websites with dumb password rules by throwaway742 on Wednesday February 15, 2023 @09:47AM (#34804493)
T-Mobile has a fun one. When creating the account they let me set a IIRC 6 digit account security PIN, but when setting up online access they only accepted a 4 digit PIN necessitating a call to customer service to reset the PIN.

Bonus Points: resetting the PIN had almost no security checks making it completely worthless as security

[ Parent | on HN ]
Re:Show HN: A compilation of websites with dumb password rules by happymellon on Wednesday February 15, 2023 @10:38AM (#34805214)
HSBC UK does this.
[ Parent | on HN ]
Re:Show HN: A compilation of websites with dumb password rules by WelcomeShorty on Wednesday February 15, 2023 @02:16PM (#34809068)
Swiss bank Cler is guilty of this too, in a way.

At (initial) password change they allow plenty of characters, but it is truncated without notice. After the password change, at login, it does not get truncated and you are not able to login, nor can you change your password ever again (until a password reset via mail (no email) arrives. Fun times.

[ Parent | on HN ]