We’ve all been there.

  • Eochaid@lemmy.world
    link
    fedilink
    English
    arrow-up
    34
    ·
    edit-2
    1 year ago

    Sorry, that password is already in use

    BIG red flag. Abort. Abort.

    Also I love when they only support certain special characters. So the psuedo random noise created by my password generator won’t work until I curate out the unsupported characters.

    • dancing_umbra@lemm.ee
      link
      fedilink
      English
      arrow-up
      20
      ·
      1 year ago

      I was changing my password on a pretty big company website the other day.

      The password generated by my password manager kept giving me a http error (500 I think)

      I generated a new password and deleted all the special characters other than the obvious ones. Boom, worked first time.

      So looks like someone is not sanitising their inputs properly.

      I sent them an email so hopefully they will fix.

      • Dandroid@dandroid.app
        link
        fedilink
        English
        arrow-up
        10
        ·
        1 year ago

        I sent them an email so hopefully they will fix.

        One can only hope. But based on my experience, they usually do not. I once sent an email to Microsoft telling them that their Microsoft account app had a vulnerability, and I even sent them the XML line they needed to add to their Android Manifest to fix it, and they wouldn’t do it because it required physical access to the device to exploit. I mean, that’s fair enough, but it was literally one line of code to plug the hole.

        They eventually did add that line about 6 years later.

        • dancing_umbra@lemm.ee
          link
          fedilink
          English
          arrow-up
          8
          ·
          1 year ago

          It boggles sometimes.

          I remember about 2015 (?) In the vicinity anyway, PayPal has a 12 character MAXIMUM on their passwords.

          PayPal, you know the place where you can literally transfer all the money. A 12 character MAXIMUM

          I emailed them to suggest they change this requirement. And they replied saying that 12 characters was sufficient if you used special characters and numbers.

          Glad they have finally changed it now.

    • pfannkuchen_gesicht@lemmy.one
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 year ago

      Funniest thing was when I registered on a website which parsed the \0 sequence and hence truncated the password in the background unbeknownst to me. This way you could circumvent the minimum length and creare a one character password.

      • magic_lobster_party@kbin.social
        link
        fedilink
        arrow-up
        6
        ·
        1 year ago

        Once I registered on a website. I used an auto generated password. Next time I tried to log in to the website I was confused that my stored password didn’t work. Requested to change the password, but I used the stored password again. To my surprise, it said the password must be different from the current one.

        After a bit back and forth I finally figured it out. Apparently the site had a max length on the password. Any password longer than that is truncated. This truncation wasn’t applied in the login form. Only when creating a password.

    • Trapping5341@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I always just refresh the password until I get a random one without the characters the randomly choose to forbid 😂