Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • catloaf@lemm.ee
    link
    fedilink
    English
    arrow-up
    7
    ·
    1 month ago

    The weirdest one I found was a site that would only check to see if what you entered started with the correct password. So if your password was hunter2 and you tried hunter246, it would let you in.

    Which means not only were they storing the password, but they had to go out of their way to use the wrong kind of string comparison.

    • wreckedcarzz@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 month ago

      USAA does this. I renentl learned that, when I updated my password a few years back to my personal standard number of characters, everything was good until someone mentioned this fuck-up in a thread. USAA only checks the first… 16? characters. I assume it just discards anything beyond that. Other users say that it warns and doesn’t let you enter more than that during password creation, but it/my pw mgr sure didn’t care, as I have a password several fold that limit. I took out a couple characters from my ‘set’ password, and it still logged in just fine. 16, just fine. 15, error.

      Fucking wild.