Yep. Having to have requirements that doesn’t flow with people very well and requiring constant updates, people WILL find shortcuts. In the office, I’ve seen sheets of paper with the password written down, I’ve seen sticky notes, I’ve seen people put them in notepad/word so they could just copy paste.
This is made worse, because you have to go out of your way for a password manager, which means you need to know what that is. And you need a good one because there has been (and I’m going to generalize here) problems with some password managers in the past. And for work, they have to allow a password manager for that to even be an option. Which you then end up with this security theater.
Not necessarily. Presumably the change password form requires entering the old and new password at the same time. Then they can compare the two as plain text and hash the old password to make sure it matches, then if so, hash the new password and overwrite it. Passwords stored hashed, comparison only during the change process. A theme on this is checking password complexity rules during the login process and advising to update to something more secure. It’s possible because you’re sending the password as plain text (hopefully over a secure connection), so it can be analysed before computing the hash. This even works if the hash is salt and peppered.
Usually 256 bit hash is used. 256 bits is 32 bytes or 32 characters. Of course you are losing some entropy because character set is limited, but 32 characters is beyond reasonable anyway.
The eff passphrase generator has about 2.5 bits of entropy per character (without word separators). Eff recommends 6 word passphrases, and with an avg word length of 7, that’s (only) 79.45 bits of entropy that won’t even fit in the 32 characters. If there wasn’t a password length limit it would be possible to saturate the hash entropy with a 20+ word & 102+ char passphrase.
I just double checked and I have TOTP enabled for my PayPal account so it should be an option.
I just found this support article of theirs and it says it can only be enabled through their website and not through the app (why?!) so you might be running into that?
Probably people would struggle to scan the QR Code with their smartphone. I think most apps can scan it from a image but obviously this would be unsafe, especially when people sync their screenshot to the cloud.
I can 100% confirm totp exist for PayPal, because I’m using it.
There’s a special place in hell for those who set an upper limit in password lengths.
Oh and also, “change this every four weeks please.”
Okay then. NEW PASSWORD: pa$$word_Aug24
Invalid password, maximum 13 characters.
pa$$word0824
Only a maximum of 3 digits allowed
password must not start with digit
Yep. Having to have requirements that doesn’t flow with people very well and requiring constant updates, people WILL find shortcuts. In the office, I’ve seen sheets of paper with the password written down, I’ve seen sticky notes, I’ve seen people put them in notepad/word so they could just copy paste.
This is made worse, because you have to go out of your way for a password manager, which means you need to know what that is. And you need a good one because there has been (and I’m going to generalize here) problems with some password managers in the past. And for work, they have to allow a password manager for that to even be an option. Which you then end up with this security theater.
coughLastPasscough
“Problems”. What an delightfully understated term to use.
the password cannot contains the same sequences of characters as the old password.
and i have seen this requirement in a service that requires changing it every month for some reasons.
and this is to manage a government digital identity that allows to log it in all governments websites.
That’s a weird way to say “we store your password in plaintext”
Not necessarily. Presumably the change password form requires entering the old and new password at the same time. Then they can compare the two as plain text and hash the old password to make sure it matches, then if so, hash the new password and overwrite it. Passwords stored hashed, comparison only during the change process. A theme on this is checking password complexity rules during the login process and advising to update to something more secure. It’s possible because you’re sending the password as plain text (hopefully over a secure connection), so it can be analysed before computing the hash. This even works if the hash is salt and peppered.
Reasonable upper limits are OK. But FFS, the limit should be enough to have a passphrase with 4 or 5 words in it.
Usually 256 bit hash is used. 256 bits is 32 bytes or 32 characters. Of course you are losing some entropy because character set is limited, but 32 characters is beyond reasonable anyway.
The eff passphrase generator has about 2.5 bits of entropy per character (without word separators). Eff recommends 6 word passphrases, and with an avg word length of 7, that’s (only) 79.45 bits of entropy that won’t even fit in the 32 characters. If there wasn’t a password length limit it would be possible to saturate the hash entropy with a 20+ word & 102+ char passphrase.
Of course, but that’s because you are using a passphrases. Passwords have a much hogher entropy.
I’d be totally fine woth 32 characters! But I’ve come across too many websites with unreasonably short (20 characters or less) limits.
Just opened a PayPal account and their limit is 20. Plus the only 2fa option is sms 🙃.
I just double checked and I have TOTP enabled for my PayPal account so it should be an option.
I just found this support article of theirs and it says it can only be enabled through their website and not through the app (why?!) so you might be running into that?
https://www.paypal.com/uk/cshelp/article/what-is-2-step-verification-and-how-do-i-turn-it-on-or-off-help167
Probably people would struggle to scan the QR Code with their smartphone. I think most apps can scan it from a image but obviously this would be unsafe, especially when people sync their screenshot to the cloud.
I can 100% confirm totp exist for PayPal, because I’m using it.
That last part definitely isn’t true.
I personally have a Yubikey and OTP for mine. Maybe they don’t for your country?
That said, fuck PayPal.
“Your password needs to be less than 65k characters long” >:(
Darn, can’t use the entire Bee Movie on Blu-Ray as my password then.
I mean you could compress it
Basically guaranteed to be a clear text offender
Especially since it takes more effort to limit it than leave it wide open for whatever length of password a user wants to use.
nvarchar(max)is perfect to store the hashed copy.