We'd lose our security certificate if we allowed pasting

Re:We'd lose our security certificate if we allowed pasting by sehrope on Tuesday May 06, 2014 @10:11AM (#7704522)

Purely a guess but I think they only allow for numbers because it's a phone company. If they intend for people to enter their password/pin on their mobile phone then limiting it to only digits that you can type from any phone is understandable. Now I'm not saying it's a good idea but at least there is some sense to it.

In no particular order my usual gripes with passwords and auth in general are:

    * Disabling clipboard copy/paste (because now I can't use my password manager)
    * Length limitations (anything less than 32 characters is a a limitation)
    * Requiring punctuation or "special characters" (they're annoying and don't add real security ... just use a longer password)
    * Lack of two-factor (preferably TOTP)

The password limit is really the scariest one. Short passwords are much easier to crack. Also, I have a sinking feeling that every site that says a password must be a specific max length is storing it in plaintext. Otherwise why the heck would it matter what the length is?

[ Parent | on HN ]

Re:We'd lose our security certificate if we allowed pasting by jamie_ca on Tuesday May 06, 2014 @12:01PM (#7705268)

Huh. I never actually did the math before, but: there's 32 symbols on my (US) keyboard. Upper+lower+number gives a baseline 62 characters. This gives us a password space for brute force attacks of

    10 char alphanum: 62^10, or 8.4e17
    10 char alnumsym: 94^10, or 5.4e19
    11 char alphanum: 62^11, or 5.2e19

One extra character instead of needing to type symbols into my phone, with nearly identical complexity? Sounds good to me.

[ Parent | on HN ]