upvote

points

by mikestew5 hours ago |
comments
upvoteby alt2273 hours ago|
next
[-]
Expiring passwords are one of my biggest gripes, and I still see them everywhere
reply
upvoteby grg03 hours ago|
parent|
next
[-]
Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?
reply
upvoteby magicalhippo1 hours ago|
parent|
next
[-]
> Why can't my password be a 5KB long?

You should switch to Windows, Microsoft got you covered[1].

[1]: https://www.betaarchive.com/wiki/index.php/Microsoft_KB_Arch...

reply
upvoteby ryandrake3 hours ago|
parent|
prev|
next
[-]
And content limits. Why can't my password contain the % character? No special characters? What makes a character "special"? Why can't it contain emoji? So many password systems go to great lengths to remove potential entropy and randomness from passwords with their rules. The usual excuse is "blah blah blah legacy systems" which is not a good reason.
reply
upvoteby fph2 hours ago|
parent|
next
[-]
Personally, I wouldn't use anything beyond ASCII in a password. I don't want encoding bugs to lock me out of my encrypted partition or bank account, thank you very much.
reply
upvoteby sfn421 hours ago|
parent|
prev|
[-]
Probably because there is some mildly decent reason (or very good, I don't know) to avoid them and it really doesn't matter enough to worry about getting around it.

Why would you want emojis in your password? It's a piece of text not meant to be seen, emojis are meant to be seen. Just randomly generate some characters and get on with your life. I don't understand why you care about this at all, it's such a pointless thing to complain about.

reply
upvoteby sgc2 hours ago|
parent|
prev|
next
[-]
I ran into a website for work that would let you create a long password, but silently truncate it to 12 characters before saving. Mind boggling.
reply
upvoteby pull_my_finger16 minutes ago|
parent|
next
[-]
I unfortunately had the infuriating experience dealing with a (government, of course) site that did this. To add to the experience, not only did it silently truncate at registration, but it did NOT truncate on the login fields. And of course, it has a lockout after several failed attempts. UX gore at it's finest.
reply
upvoteby halJordan2 hours ago|
parent|
prev|
next
[-]
This is the best. Especially when the password is being autotyped by the pw manager and so you never see the truncation and now have a bad pw saved in your manager. Alongside a restrictive password policy with no ui explaining what the policy is.
reply
upvoteby j4k32 hours ago|
parent|
prev|
next
[-]
This happens on some HP printers too, the web interface lets you happily enter lengthy passwords, but doesn't bother telling you it truncated the entry at 16 or 12 characters.
reply
upvoteby grg01 hours ago|
parent|
prev|
[-]
Blizzard/battle.net used to this (still does?), lol
reply
upvoteby sfn421 hours ago|
parent|
prev|
next
[-]
> Why can't my password be a 5KB long?

Probably because that's just unnecessary. A few dozen characters is plenty, anything beyond that is just excessive.

reply
upvoteby mschuster913 hours ago|
parent|
prev|
[-]
I wouldn’t trust enterprise internet security boxes to not trip on such long text fields.
reply
upvoteby wildzzz55 minutes ago|
parent|
prev|
next
[-]
One good thing about expiring passwords is that it forces you to use something that you probably don't use for everything else in your personal life.
reply
upvoteby wpm3 hours ago|
parent|
prev|
next
[-]
My company does it to our phone passcodes. 90 days.
reply
upvoteby black61 hours ago|
parent|
prev|
[-]
Due to corporate IT working its fingers into everything vaguely computer related, I now have to annually change the passwords that operators use to log onto the HMIs on my OT network (which has no connection to the greater Internet.)

That means I now get calls after hours for a couple weeks (allowing for all shifts to cycle through) from operators who are locked out of their ops stations. I can't send the password via email, obviously, and word-of-mouth is inconsistent at best. So I'm left with the sticky note under the keyboard or stuck to the monitor, which the operators won't read anyway.

reply
upvoteby mikestew2 hours ago|
prev|
next
[-]
Replying to my own post: wait a minute, why are there so many accounts with the same password in the first place? Oh, because "dozens" of people are tired of changing their password every 90 days, and someone piped up on an email thread (with the subject line: "Changing passwords all the time is bullshit!", I'm sure) and said, "I just set it to $SEASON$YEAR'!'. Easy to remember, fits the policy."

And now you have a system that is far less secure than if you just ditched the expiration policy to begin with.

reply
upvoteby Xeoncross5 hours ago|
prev|
next
[-]
1. Open a web browser and do a search

2. Read until you find a sentence that you like.

3. Use it as your password

reply
upvoteby raffraffraff4 hours ago|
parent|
next
[-]
How about mixing up band names? Take the end of "Florence and the machine" and mix it with the start of "Rage against the machine" and you now have the totally unguessable "Rage sharing the machine". It's a different machine see?! Nobody would know that!
reply
upvoteby NopIdoN3 hours ago|
parent|
[-]
The The but the first The is from The Who
reply
upvoteby ChrisRR5 hours ago|
parent|
prev|
next
[-]
I like the last line of your comment

My password is now password

reply
upvoteby daredoes4 hours ago|
parent|
next
[-]
Should have been "use it as your password"
reply
upvoteby nickweb2 hours ago|
parent|
prev|
next
[-]
That's cool. Yours comes up as stars (*). Must be a HN thing.
reply
upvoteby glitchc5 hours ago|
parent|
prev|
[-]
Not enough numbers or special characters usually.
reply
upvoteby lukan4 hours ago|
parent|
next
[-]
Use one specific special character/number as word separator.
reply
upvoteby chopin4 hours ago|
parent|
prev|
[-]
I loathe two things in password requirements: special characters and not allowing spaces. C'mon, it's 2026. Require 20 characters and call it a day.
reply
upvoteby Xeoncross4 hours ago|
parent|
[-]
"password is to long, max length..."

(╯°□°）╯︵ ┻━┻

reply
upvoteby Volundr3 hours ago|
parent|
[-]
I couldn't decide which sentence of Alice in Wonderland was my favorite, so I just used the full text.
reply
upvoteby 4 hours ago|
prev|
next
[-]
deleted
reply
upvoteby samrus4 hours ago|
prev|
next
[-]
I swear if the ghouls running things had abit more decency and allowed people to actually access and controll their passkeys then that would be the future, everyone would adopt it. The experience is so nice with key pair exchange for ssh. Its just that there i have thr security of knowing exactly where my secret is and how i can manage it, its just a file and i can move it like a file

Nobody wants the risk of getting locked out because of apple and googles walled garden bullshit

reply
upvoteby James_K4 hours ago|
prev|
[-]
Letting users pick their own passwords has always been a mistake. If passwords are needed, the system should choose them.
reply
upvoteby NopIdoN3 hours ago|
parent|
next
[-]
just directly give them a post-it for their monitor
reply
upvoteby kg3 hours ago|
parent|
prev|
[-]
As a person with memory issues, this is a recipe for me writing a password down where somebody else can probably find it.
reply
upvoteby ryandrake3 hours ago|
parent|
next
[-]
If your machine or service is connected to the Internet, 631U)VN0Onl? written on a post-it note is generally going to be better than hunter2 not written down.
reply
upvoteby fouc3 hours ago|
parent|
prev|
[-]
but post-its are vulnerable to the wrench attack!
reply