this post was submitted on 21 Jun 2024
0 points (NaN% liked)

Software Gore

965 readers
2 users here now

A community for posting software malfunctions

Deliberately bad software or bad design is not software gore, it must be something unintentional

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient and shear it



founded 11 months ago
MODERATORS
 
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 0 points 4 months ago (6 children)

I use a password manager with a random password generator. It's always disconcerting when I find a website that finds my passwords to be too complicated. Like "you can't use more than eight characters and the only special characters you can use are @ and !". What the shit?!?

[–] [email protected] 0 points 4 months ago

I only remember that happening once, but it wasn't some random super small site, it was Uplay. I think the limit was 14 characters, or maybe 16 I'm not quite sure, but either way it was utterly stupid.

[–] [email protected] 0 points 4 months ago (1 children)

Typically, the account creation will fail without saying why.

Is it because the site is broken? Because I already have an account? Because I used too weird a password? (10 minutes later) ok, it's because it's coded by idiots and it can't handle a 24 character password but a 12 character one works.

[–] [email protected] 0 points 4 months ago (1 children)

I once experienced a site just silently truncating a password that was too long. Such a ridiculous thing to do. It was several years ago, gaming related. I think it might have been Ubisoft, but I'm not sure that I'm remembering that correctly.

[–] [email protected] 0 points 4 months ago

I'm sure that it silently happens a lot.

[–] [email protected] 0 points 4 months ago

"you may only use characters that we can store in a plaintext SQL field"

Oh man I fuckin hate that shit

[–] [email protected] 0 points 4 months ago* (last edited 4 months ago) (1 children)

Yeah! Why can't I use a base64 representation of a pirated 4k TS copy of Jon Favreau's "Chef" as my password? /s

Jokes aside, I've heard some hashing algorithms have a high cap of like 20 characters, so developers are probably just too lazy to switch them out or to read the docs on how to properly use said algorithms. Either way it's a very bad sign, maybe just a tad better than them emailing you the password in cleartext.

[–] [email protected] 0 points 4 months ago

The worst I have seen recently is one with an eight character limit and support for only four specific special characters. I didn't test if it was cap sensitive but it wouldn't shock me if it was not. It is the invoicing portal for one of my clients. I wish that was the only technical atrocity committed by that abomination...it is not.

[–] [email protected] 0 points 4 months ago* (last edited 4 months ago)

generate 32-char-pw -> "Must not be longer than 20" 🤨

generate 32-char-pw -> "you must include a specific special character" 🤨

below 10 characters is truly atrocious - and thankfully rare

[–] [email protected] 0 points 4 months ago (1 children)

We have a system that mails your password if you change it. It's just for internal users, but still.

[–] [email protected] 0 points 4 months ago (1 children)

That means those suckers are either stored plaintext or stored with decryption key that is somewhere within the server. Yeesh.

[–] [email protected] 0 points 4 months ago

"if you change it". It might send the email before storing it as a salted hash in the DB. Unlikely, but possible.