How on earth can you both not accept the password I copied from my password safe and tell me that I cannot use the same pasaword again?
You must log in or register to comment.
I had this happen once where input validation on login and password change were different. I was allowed to set my password to a string containing a special character not accepted by the login form. Top men.
This often happens when you entered the right password but have a typo in the user name. Everyone tries the password again, but nobody spell checks their email or username.
You’re right, this is plausible
Get a password manager.
As someone who regularly uses a vpn, I’ve noticed that there’s a surprising number of sites that will just lock your account if they decide they don’t like your ip address.
Yeah, I hate that. They don’t always lock it but will just reject the password with no indication of why.
I once had to reset my password as the new one got truncated without telling me.
Yes. It was deemed too long.
It was for an company that got plenty of my personal data
Why on earth would someone truncate a password? I could make at least 10 more memea about bad handling of passwords
There’s no good reason. Whoever did it, did it for a bad reason. (Oh, well, there’s no good reason until you reach several thousand characters.)
That said, it could be worse. Some sites do not truncate your password at the creation form, and only truncate it on the login screen. (Yeah, that happened to me, in 2 different sites.)
Why? Probably some wild row length limit being hit where a table storing user data was storing an asinine amount of data, just terrible DB organization in an org where someone said “who even needs a DBA.”
How? If you can truncate user passwords, you should never handle user passwords again, unless you’re a student or hobbyist learning a valuable lesson.
How? If you can truncate user passwords, you should never handle user passwords again, unless you’re a student or hobbyist learning a valuable lesson.
Yeah. The real reason to be alarmed is worse than the obvious one.
If a partial version of what was originally set actually works later, it implies a scary chance they’re not even hashing the password before storing it.
Also suggests the user may be reusing the same prefix if only the changed bits are getting truncated.
Should use different random passwords every time. Completely random or a random string of words. While it doesn’t solve the cleartext password storage issue, a data breach won’t compromise all your other accounts to same degree.
Doesn’t hurt to also randomize usernames, emails, and even security question answers.
edit: or my new favorite passkeys, just make sure you trust whatever tool is managing your private keys.
If there has been a data leak, they might block your current password because the hash has been leaked
If there has been a data leak, they might block your current password because the hash has been leaked
I’m sure that makes them feel much better, lol.
The leak doesn’t even need to happen on their site, they could check the password hash against known leaked hashes (from have I been pwned for example) and block it
Yes, that might be a plausible theory. Basically a bad yersion of you must change your password.
How would that be considered bad? Is this some meme I’m too stupid to understand or something?
It would be better if the login flow said something like
For security reasons, we ask you to set a new password, please use the “password forgotten” function to gain access again.
instead of me being puzzled why my password doesn’t work.
except now anyone guessing your password knows when they guess your password right? while that site is safe most users use the same password and any site they use with the same email is now vulnerable.
Yes… but your credentials are already for sale in the darknet
Only the hash, not the password
They’re lying about the issue and don’t trust that you’re who you say you are. It’s security systems 101. If you give informative error messages, they can be used to reverse engineer the password of accounts. So every error is going to be “incorrect password”
That part is possible:
They’re lying about the issue and don’t trust that you’re who you say you are.
The rest of your comment is just bad. I doubt you even manage to keep that information secret, much less get a positive value out of the entire machination.
Sounds like security by obscurity to me. Works, but rarely the best solution.
Lol I usually abort the password reset flow and try to login with the same password lmao
It’s like when you are trying to blindly install a USB type A . First orientation is wrong so you flip it. Second orientation is wrong so you get confused and flip it again only for it work easily lol.
They could be truncating the password in one form but not the other.
