I logged in to a website today and found this message:
As a part of new security systems upgrades, we are requiring all existing customers to change their password to enhance the protection of their private information.
We recommend using a password which is easy for you to remember but difficult for others to guess. Please note the new password should be between 8 ~ 16 characters and special characters, "'", """, ";", "|", "?", "<", ">", "^", "*", ":", "=", and "#" are prohibited. Thanks for your understanding and cooperation.
16 characters is probably long enough, but I don't see a good reason for the length restriction.
More interesting to me is the disallowing of certain special characters. There are still plenty of special characters available with this scheme, though I've heard of other sites that only allow alphanumeric characters. Why should the content of my password matter to the hashing algorithm? It's just a hash, or a base-64 encoding of that hash, right?
- Does this policy place the security of my account at risk?
- Is there a specific password handler can't deal with the character set
- Should I be concerned about the security policies elsewhere on the site?