What are some of the most unhinged (good or bad) password requirements/rules you've seen?

Not so much password requirements as just a completely *removed* implementation:

To access payment stubs in a data center (not us) that I worked at, the user account was our public email address and the password was a personal code, sorta like SSN, but that code could be easily looked up as it was public info.

I showed the director of HR, who authorized this her own payment stub as evidence that this was baaaaadddd

So she asked me to check that system for more issues

Turns out it stored passwords in blank (wtf) and would authenticate with two queries. First query would check if the username (email) exists. Second query would check if the password exists. If both exists, you're in! So i could login to any account with MY password...

This is a tip of a very big iceberg there

Passwords that must contain a special character, but only from a list of three special characters.

Passwords that must be changed every 3 months.

Absurdly narrow length requirements, im 80% sure I saw one that required 8-16 characters.

All dictionary words were banned from being in a password regardless of length, so passphrases weren't allowed.

1. There was the multi user operating system in the 1990s that required every user to have a unique password. We were young and innocent then and used common English words. Upon changing your password, it would check your new password against all other users. An error like

That password is already used by johnp. Please choose another password.

was not uncommon.

1. When I started using a password manager, I got keen and changed my passwords to 64 random characters. My bank would change this to uppercase, delete special characters, and save the first 8 characters of what was left. So when I logged in, it would compare the 64 character password I entered to the converted 8 character password that they saved, and find that they were different. (I found this out when I rang and complained, and they told me my password over the phone … 😱). They don’t do that any more.

My community colleges:

Passwords must be 12 characters long, contain at least one uppercase letter, one lowercase letter, a number, and a special character; it must also be changed every 30 days. There was also some sort of alogarithm that checked if your new password is too similar to any previous password you had used, and rejected it if it was too close.

Hilariously, if you had a link to the page the password was supposed to limit access to, you could bypass the password page entirely. As such, I never changed my password.

The oddest I've ever encountered: EXACTLY 15 characters long. No more, no fewer. 15.

Honorable mention: Various online accounts where I used my password manager to generate a long, secure password, which the website accepted without warning or error. I was then locked out because their user management system could not handle such long passwords (had to create a second account with a much shorter password to find that out) 🤣

Not allowing you to paste a password, so you have to type it manually every time.

My old bank required you to have a password 12 characters long exactly, and to login you have to give the characters in specific places.

I would ask you what are the 4th, 7th, and 11th letters of your password.

Anyone want to guess why that aren't my bank anymore?

Stupid bank app doesn't allow password managers... and if you hit the enter button to login you get an error message informing you that you need to mouse click on the button.

My work was using some MS-based account system, but I don't know if this was stock or something they modified. When you had to change your password, it would tell you if your new password didn't meet the password requirements, as usual. What it wouldn't tell you was what those requirements were...

So yeah, the requirements the system won't tell you about would have to be the worst one i came across...

By far the worst is the costa rican national bank:

• Must be between 8 and 16 characters long
• Must have at least 4 letters and 4 numbers
• Can't have consecutively repeated characters (can't do "aa" but can do "aba")
• Can't have vowels or Ñ
• Must not be one of your last 6 passwords
• Must be changed every 90 days
• Also forgot that their website and app try to block password managers and copy and paste

Probably the silliest thing I have run into was some game. It asked you to set *two* passwords. You needed both to login. The second password *couldn't be changed*. This is why it was secure, see. (...What.)

When I created my account and set the second password, I couldn't log on the *second time.* Because I had entered a 20 character second password. It was accepted and verified during the account creation just fine. On the second login, it only accepted 16 characters. (It let you *enter* 20 characters but said it was too long.) Trying to enter first 16 characters of the second password didn't work, of course.

I then contacted the support, and they did manage to reset the second password anyway. (What is this even)

A company I used to work for is big enough that everyone reading this has heard of it. They had this wonderful security nightmare going on:

When you were hired, the company would issue your user credential with a standard password that was "CompanyName1" and require you to immediately change it at first logon. Everyone knew this password because everyone got it when they were hired.

Password policy required everyone to reset their password every 60 days. Not the worst ever but still pretty aggressive. And with the rise of all the mobile devices connecting with your corp account it was getting to be a worse and worse experience.

Can you guess yet how these two policies are linked in my story?

Well, some of the C-Suite executives didn't have time for any of these security shenanigans. So they would have their executive support person log into an administrative console and reset the exec's password every 59 days to the same value that it currently had, thereby bypassing the password re-use filter.

That value they were continuously setting was... "CompanyName1"

I know of at least two executives that were doing this while I worked there.

I had a wi-fi device a few years ago that would require a password up to 12 characters, but that requirement wasn’t explicitly written anywhere. The device would gladly accept a 13-character password, for example, but you would never be able to log in again (factory-resetting was the only way to undo).

More recently I purchased a Lennox HVAC system that came with their proprietary thermostat (an Android tablet with a wall mount). During the Christmas break I got myself a new wi-fi router and had to reconfigure all my wireless devices. After 2 days, the Lennox thermostat was the last device to join the new wi-fi network… and it failed because their password could have any character EXCEPT the asterisk — and my new password had an asterisk. I didn’t like the idea of redoing all my other devices AGAIN just because of this idiotic password rule, so I ended up creating a new SSID just for the thermostat. I named it LENNOXSUCKS.

Not sure if it falls under the same category, but the way Activision handles (handled? I haven't used them since) passwords was atrocious! I had to reset my password to get back into my account, I used a random diceware password, it accepted it. However! The client on both Windows and Xbox wouldn't let you input a password longer than I believe 20 characters. So while you can set a 25 character password, you can go fuck yourself if you actually wanna log in...

12 characters, upper/lower/special requirement, and no more than two occurrences of the same character together. That's FedEx.

Two other thoughts on the topic:

• Websites/apps/etc should always list their password requirements on the login page to make it easier to determine what password you used for the site in question.
• There are plenty of websites where I literally log in only by using the "forgot password" flow because their password requirements are so ridiculous.

"Password must contain letters numbers, and at least one of these special characters."

Turns out, half of those special characters weren't allowed 🫠

Extremely limited password length. I think it was around 6 or 8 characters. Exactly! So every password was the same length.

No other requirements. The best part? It was a bank. But not a customer facing service.

One special character.

Seems logic right? Until you get that it is one and one only. Took me some time.

I had to log back into an account for an app (I think Taco Bell) that decided to remove passwords entirely without any notice. You typed in your email address, had to open your email account and click a link they sent you, it would open a webpage, which would then have a button to open the app again. If I remember correctly too, it would only work on Chrome, so I had to copy and paste the link since Chrome isn't my default browser that automatically opens from my mobile email.

Besides that, I remember some website required a special character from an extremely small list and wouldn't allow two of the same letter back-to-back.

[offtopic?]

Debbie's password is "PlutoGoofyMickeyMinnieDaffyBugsThorLosAngles"

She was told that the password needed seven characters and a capital.

My favorite is a major credit card company with case-insensitive passwords. They also only allow a small handful of special characters, so the total possible character space is roughly 42 characters. Needless to say, I chose to use a password that was the maximum allowed length (which was sadly also only 32 characters).

Worked somewhere that required security clearance that used your national insurance number (UK equivalent to SSN) as your login id. Most people in the UK do not memorise their NI number.

Password had to be uppercase and lowercase letters, numbers, and special characters, I think at least 12? Couldn't have back to back special characters or start or end with numbers. No whole words, either.

So now you have to remember two strings of letters and numbers. Sackable offensive to write either down. I once got a phone call from security because I would miss enter my password after lunch first time around, just once a day, but they rang me up still to see what going on.

Security there was a nightmare, worked with an obviously disabled guy, who forgot to put his disabled badge on his car dashboard and they threatened to ban him from site (which would result in the sack as you couldn't work remotely). The kicker was that they said we know you forgot to put the badge out, so they knew he was disabled as all car registrations are preregistered only way onsite.

Anything that requires regular password resets. It's fine if it's changed on the site and in the user's vault automatically, but if a user has to type in their password with any sort of regularity, it's a recipe for disaster to require regular changes.

People write predictable or formulaic passwords, or just end up resetting their password more often than necessary because they forgot it (making them more susceptible to phishing).

Facebook got caught having a flat text file being send around between employees to make accessing data easier. That text file contained tens of thousands of peoples username and password.

Why? Facebook being facebook I guess

It happens a bit too often that I make an account somewhere with a long, generated password and then when I log in it throws errors at me.

But a few times a website didn't just show me an error, I got the whole crash dump including their encryption approach and versioning

The worst I've ever seen was a site that required passwords to be 4 digits.

Most absurd was from a job I had in college. This was the password to log into an ancient dumb terminal (literally a monochrome black and green display) on a local-only network that only handled our time clock.

Requirements: * 8 characters exactly * You supply the first 4, the system generated the last 4 * I can't remember if it allowed numbers, but there were definitely no special characters and I think it was also case-insensitive

Required to change password every 30 days.

Password needs one special character.
Not at least one. Exactly one.

The most funny one was a professional and rather costly password checking tool.

Besides the usual other rules, it had a rule that the new pw must not be similar to the old one. For similarity, this thing checked each character in it's place.

So you could have the old one:
"MyAssMy$1" and the new one:
"$1MyAssMy" and it was not similar at all :)

I add to make a password last fall that had the requirement "numerals or special characters". A password with *both* numerals and special characters wouldn't work.

I volunteer at a local high school and the students password is their birthday, because they are given their account at age 5, in kindergarten, and it's something you can reasonably expect a 5 year old to remember. Also, the students are not allowed to change their password unless they get "hacked", which is usually just another student logging into their account and deleting their assignments.

The most basic rules commonly required everywhere. When you have such specific rules, it ironically actually makes finding the password through brute force *easier* because you can eliminate a bunch of variables that could have existed without all the rules. I can eliminate any permutation under 8 characters, doesn't contain a number, and doesn't contain a special character.

It will still possibly take a billion years to guess, but it could have been *two* billion without the rules.

Of course, I also find it wild that the metric for how good an encryption or password system is, is just how long it would take to guess every possible combination of input it could be, sequentially. It doesn't account for a brute force attempt that just selects *random* inputs. It could take until the heat death of the universe... It could take 3 seconds. It's up to chance at that point. Not to mention all the easier ways of getting a password. Like gaslighting the person who knows it into giving it up.

Max length of something under 18 …

Irks my gears

I hate any password requirement that says "special characters" but has a list of exceptions, like no . , ! ; or empty spaces. Just tell the user to make a pass*phrase*, enforce at least one empty space and, dunno, 25 characters minimum, and bam. It's not like hackers try brute force anymore, they just hack insecure DBs full of user data and use that everywhere.

Six numbers only.

Obligatory link to neal.fun password-game

I've encountered a few sites that restricted repeating or sequential characters. Of course told after failing the first creation attempt. Makes things like randomly generated passphrases fun to figure out. Particularly when their idea of "sequential" involves both in alpha/numerical order, but also adjacent spacing on the (assumed?) qwerty keyboard!

Anyone remember the Password Game?

I personally hate character limits. I understand minimum character count, but I can't have more than 15 characters? Bruh

There is such a thing as good unhinged?

I'm going to need an example here...

I needed to get a certificate for digitally submitting my taxes. This, of course, requires me to set a password for it. The tax office' web site lists a number of requirements and rejects any password that does not match those (so it said). So far, so good, the usual stuff, lower and upper case, numbers, special characters, minimum lenght. No surprises there.

For one of the "special characters" I used "ö" (umlaut o), which is a normal character in my language (which is the same as the tax offices, so they should be aware of those). The web site filter happily accepted this password containing the "ö". But the back engine got a severe case of digital diarrhea from it. I had to clear my caches and cookies to completely re-starting the application process.

Another password SNAFU I had many years ago in a place using TN3270 terminals. To those who have never seen such a thing, it is a so-called "smart terminal". It does not send and receive single characters like a telnet or SSH session, but the host sends a mask to the terminal, defining fields that can be filled out, and with a "send" or "function" key (IIRC) you could send the data back. Those fields had fixed lengths, of course. You might guess the problem...

So the login screen had two fields of eight characters each: "Username" and "Password". I entered the credentials I have been given and sent them. The first thing I did was to select "change password". It opened a form with three fields: "old password", "new password", and "repeat new password". Nothing odd about that, but the fields had *twelve* characters. So, not knowing the particulars of that system (I was used to UNIX style terminals back then), I entered a new password that was longer than eight characters. Guess what? I logged out, I tried to log in, I was stuck. I had to ask my admin to reset my password. And had found the first of many, many bugs in that system.

Any service that says I must have a 12 or 14 string password, combined with symbols, numbers and letters.

Do you know why, I have to keep resetting my password, services that have this dumb requirement? Because your fucking requirements are absurd and unnecessary. I don't have the mental capacity to care to remember that long of a password. I have to have a document now of all of the passwords I have so it's not forgotten. I have to have browsers autofill for me because of this shit.

In a perfect world, 6 - 8 string passwords would suffice and lots of emphasis on symbols and numbers at the very least. The longer you try making the characters of a password, the chances of forgetting increases.

Flickr does this. Some of the portals to my apartment portal does this. Portals to some of my medical information does this. It's fucking bullshit. StateFarm does this too.