Sites with dumb password rules (github.com)

Article summary

A compilation of sites with dumb password rules has been created, showcasing various websites with poor password policies. The list includes sites with case-insensitive passwords, character limits, and other restrictive rules. The compilation aims to highlight the need for better password security practices. The project also has a bot that periodically posts random rules from the list.

Main themes

• password security
• dumb password rules
• website security practices
• password policies
• character limits

What commenters say

• Some websites store passwords in plaintext, as evidenced by their ability to enforce case-insensitive passwords or check for similarity to previous passwords.
• Implementing a maximum password length can be reasonable for security and performance reasons, but it should be clearly communicated to users and consistently enforced.
• Silent truncation of passwords can be a significant security risk, especially when different platforms have different length limits.
• Client-side hashing can potentially improve security by reducing the risk of denial-of-service attacks and preserving password entropy.
• A standardized HTML specification for password requirements could help password managers generate valid and secure passwords.
• Enforcing strict password rules can sometimes be more of a hindrance than a help, particularly when it leads to frustrated users or security vulnerabilities.
• Some companies may prioritize user experience over strict password security, allowing for some flexibility in password rules to accommodate common user mistakes.