News for hackers. Stuff that matters.

A comment on Zxcvbn: realistic password strength estimation. Parent comment

Re:Zxcvbn: realistic password strength estimation by _delirium on Tuesday April 10, 2012 @03:46PM (#3824025)
A not-very-great but traditional way to avoid some kinds of security holes is to sanitize your input by blacklisting anything that could be a shell/scripting/SQL metacharacter. Seems restrictions like that are still pretty common, either because it's actually still needed for security (alarming if true at BoA), or because it's now a sort of cargo-cult thing.
[ Parent | on HN ]
Re:Zxcvbn: realistic password strength estimation by landr0id on Tuesday April 10, 2012 @08:48PM (#3825338)
That's what I had assumed, and I recently started web development so I'm not very educated on some of this stuff, but it seems to me like that could easily be avoided if things are done right. It's a banking site though, so I guess any extra protection to protect those users is good.
[ Parent | on HN ]
Re:Zxcvbn: realistic password strength estimation by lowe on Tuesday April 10, 2012 @03:58PM (#3824086)
sounds about right. screenshot of BofA's policy here: http://dl.dropbox.com/u/209/bofa_password_constraints.png

the forbidden list is: $ < > ^ ! [ ]

[ Parent | on HN ]
Re:Zxcvbn: realistic password strength estimation by hbhanu on Tuesday April 10, 2012 @04:33PM (#3824258)
Huh, thanks! I suspected it was a security thing, but I've seen some sites where other non-alphaneumeric characters were disallowed as well. :/ At least this makes some sense.
[ Parent | on HN ]