up vote 3 down vote favorite
share [g+] share [fb]

I logged in to a website today and found this message:

As a part of new security systems upgrades, we are requiring all existing customers to change their password to enhance the protection of their private information.
We recommend using a password which is easy for you to remember but difficult for others to guess. Please note the new password should be between 8 ~ 16 characters and special characters, "'", """, ";", "|", "?", "<", ">", "^", "*", ":", "=", and "#" are prohibited. Thanks for your understanding and cooperation.

16 characters is probably long enough, but I don't see a good reason for the length restriction.

More interesting to me is the disallowing of certain special characters. There are still plenty of special characters available with this scheme, though I've heard of other sites that only allow alphanumeric characters. Why should the content of my password matter to the hashing algorithm? It's just a hash, or a base-64 encoding of that hash, right?

  1. Does this policy place the security of my account at risk?
  2. Is there a specific password handler can't deal with the character set ',";|?<>^*:=#?
  3. Should I be concerned about the security policies elsewhere on the site?
link|improve this question
I hate sites like that. Almost all of my passwords have one of those characters, if not multiples. – Reid Apr 9 '11 at 17:48
@Reid - Mine, too. That's why I'm here! What do you do about it? – Kevin Vermeer Apr 9 '11 at 18:06
@Closers - De-localized it somewhat. – Kevin Vermeer Apr 9 '11 at 20:04
Update: (Quote) Thank you for your email and the opportunity to respond to your concerns. Customer passwords are encrypted in our database. The reason that we limit the special characters is because we have a Web Application Firewall that may falsely interpret them as a SQL injection attempt that would cause an error to occur when submitted. By restricting these characters we minimize the likelihood of this occurring. (/Quote) – Kevin Vermeer Apr 11 '11 at 20:02
"Why would some..." instead of "Why do some..." would probably make for a less localized question. And might I add, I think it's a pretty good question! – Beaming Mel-Bin Apr 12 '11 at 16:17
feedback

closed as too localized by Shane Madden, Jim B, Iain♦, Scott Pack, DJ Pon3 Apr 9 '11 at 18:05

This question is unlikely to ever help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. See the FAQ for guidance on how to improve it.

3 Answers

up vote 5 down vote

Almost certainly to stop people embedding code inside regular fields (a la SQL injection).

link|improve this answer
4  
It's a shit way to do it though. – Tom O'Connor Apr 9 '11 at 17:50
Does this mean that they're not properly sanitizing and filtering their inputs (implying that they've got poor security practices, and I should start shopping elsewhere), or is this just another layer of protection? – Kevin Vermeer Apr 9 '11 at 17:53
1  
Ghetto-sanitisation I'm guessing. – Chopper3 Apr 9 '11 at 19:46
Almost certainly ghetto-sanitization; honestly sites like this should be deeply ashamed of their (in)security practices, but apparently their not. This stuff ain't that complicated, but it does take minimal effort, and some people simply aren't willing to put out. – Chris S♦ Apr 10 '11 at 0:43
feedback
up vote 2 down vote

Should I be concerned about the security policies elsewhere on the site?

Yes, you should.

Because if they are able to know what characters are in your password, that means it's stored in plaintext in the database. And this is BAAAD.

link|improve this answer
I would hope they have some client side validation that weeds out invalid characters and then assuming it passes the test it is then hashed in their database. Obviously I could be wrong, but thats what I would expect. – Sam♦ Apr 9 '11 at 20:07
When setting the password it has to be sent in plain text so it can be stored without nonce (or other) encodings that make it session unique. – Chris S♦ Apr 10 '11 at 0:40
feedback
up vote 1 down vote

Because they did a crappy job of sql injection prevention. I can almost understand not allowing ' and " (your grade goes from F to C) everything else is simply sloppy

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.