{"id":253,"date":"2016-01-08T07:34:56","date_gmt":"2016-01-08T14:34:56","guid":{"rendered":"http:\/\/www.businesstechnologyassociates.com\/blog\/?p=253"},"modified":"2016-01-16T15:47:23","modified_gmt":"2016-01-16T22:47:23","slug":"password-shenanigans","status":"publish","type":"post","link":"https:\/\/www.businesstechnologyassociates.com\/blog\/2016\/01\/password-shenanigans\/","title":{"rendered":"Password Shenanigans"},"content":{"rendered":"

There seems to be a trend in web security that requires that you type your password, no pasting allowed!<\/strong><\/p>\n

This combined with other password “requirements” are creating problems for people like me that use very secure long passwords.\u00a0 That means I use a password safe<\/a> that generates long random strings of letters and numbers like:<\/p>\n

\n
kUTaVYPuw6KdCLsqhfJ35qHdZcgCqR<\/pre>\n<\/blockquote>\n
BTW, this password is random and not used by me, anywhere!<\/p>\n
So when I sign up for a site that does not allow pasting my really secure password, but requires that I type it manually, I end up with passwords like:<\/p>\n
\n
Secure4Stupid!<\/pre>\n<\/blockquote>\n
Making my password much less secure. Also most sites use the “onpaste=return false;” trick.\u00a0 This only stops the stupid people, as 5-15 minutes with a Greasemonkey<\/a> script will defeat that “security” feature.\u00a0 So let’s not think that every idea about password security is a good idea.<\/strong><\/p>\n
Even the following idea is probably not that secure<\/strong><\/a> given that password crackers use dictionaries that contain the words: correct, horse, battery, and staple.<\/p>\n
\"xkcd<\/a>Another annoyance is sites that do not tell me what the maximum length is for a password on their site.\u00a0 Almost no one tells you this even though they tell you, you must enter at least 8 characters, using letter and numbers….\u00a0 Since I have had several sites truncate my password, without error or warning<\/span>, I now have to look at the HTML source code to see if a hint is there.<\/p>\n
So here is some password advice for web-site developers and their customers.<\/p>\n