Credential creation should always state the maximum password length

15. March 2008

Some of us have use password managers such as Roboform to manage passwords. Since Roboform allows me to generate a random password of any length, I want to know how many characters to make my password when I create a user for a site. Unfortunately, most sites do not tell you the characters allowed much less the the maximum number of characters allowed. When it is a newspaper that does this, I do not care as much but when it is a bank or financial institution it is a true annoyance.

The worst type of annoyance is the site that not only does not tell you the maximum password length nor which characters are allowed, they quietly accept whatever you give them and shove your round peg entry into their square hole system leaving you without the ability to login. For example, I encountered a site recently where they did not set the MaxLength property on their textbox entry. When I entered my randomly generated password, it accepted it and saved it to their database which promply truncated it at its maximum number of characters, also without throwing an error. Logout. Login. Bad Monkey. On having them send me my password (also a bad policy, it should reset to a random password, send that to me and require I change it but that is another rant) and having encountered this problem enough, it was clear what had happened.

I have come to accept that most sites will accept passwords of 10 alphanumeric characters. If they are kind enough to tell me the actual length and characters accepted, then I adjust Roboform accordingly.

General

blog comments powered by Disqus