Just take the string as bytes and hash it ffs
You remind me of my bank about 17 years ago. Everyone had to have a 10-character password, exactly, and it had to include exactly 2 numbers and 1 symbol. I wasn’t very knowledgeable about computers at the time and it already felt dumb.
17 years ago, jeez. My credit Union’s website is like that. Only its between 8-12 characters. No more, no less.
It’s terrifying.
A few years ago my ISP pushed an update to my router that changed the password requirements, invalidating my passwords. Because I couldn’t enter the old password I also couldn’t change the password. I had to do a factory reset.
ISP worker here. Our chosen routers default to an 8 digit password, the first 4 are the last 4 of the mac in hex, which anyone can easily see being broadcast by the wifi network. The last 4 are a part of a unique serial number, but its just 0-9. Ultimately, if you try to brute force this default password, you need 10000 tries. It takes a regular GPU 2 minutes with hashcat. It baffles my mind that companies think this is OK.
Wow that’s a big oops
Feels odd to check the password requirements on the enter password screen in addition to the new password screen.
Might be checking the old password on the new password screen. Easy programming mistake to make I guess? Apply the same validation to all 3 password fields…
Ahhh, good catch! You are probably a master of code reviews and QA!
At that time my bank allowed up to 6 digits as a password. I kid you not, like a card PIN but for online banking login. I believe the whole banking security relies on their backoffices still running on paper.
That’s what my current bank uses for the web portal now to think of it. Client number, and 6-number PIN. I guess they’re only doing this because they really trust their “unusual activity” protocols, but I’ve got a feeling they really shouldn’t only rely on those.
Assuming we can use both lower- and uppercase letters (52 in total), with the ten digits and the underscore that gives us 63 characters to work with. A random 16-character combination of these gives us 95 bits of entropy (rounding down), which is secure enough by modern standards, at least for a home router.
Regardless, I understand the frustration of arbitrary limitations preventing you from choosing a secure password in a way that you’re comfortable with.
I HATE THIS SOO MUCH AHHHHH
TP-Link… TP-Link…
I don’t trust your bottom barrel software, TP-Link…
True trash-tier software and hardware. Last year I was having trouble with frequently dropped packets from my office computer. I thought it was a Spectrum issue until I tore everything out and started testing all my ports (modem, router, wall ports, etc). I FINALLY narrowed it down to the relatively new TP-Link dumb router I bought. I threw that piece of trash in the garbage.
Never again.
underlines
german programmers trying to translate Unterstrich
/^\w{6,16}$/Those cases where an english word gets absorbed even though no one from the origin talks like that. It’s also informally called underline here in Brazil lol.
Just do the Password Game to figure out a good one!
Lol. Imagine thinking TP Link takes security seriously.
I had one of those “fancy” Vodafone routers included with my broadband which had a stupid rule set on choosing the WiFi password. It’s my network, not yours, stupid router. It can be as insecure as I want.
Anyway the rules were enforced by the JavaScript so it was easy to bypass until I got my own router to replace it with.
It’s important to note, that these things are designed for the average user. If you want to change the wifi password, you are by far not an average user. Most users just plugs in and never even think about that, and the number of that kind of users are several order of magnitude higher than the conscious ones. For them it’s much more secure to set a random pw. If you let them select a password they will choose
12345orpassword.If you know what you are doing usually it’s better to buy your own router where you can change everything the way you like.
If we could magically get the data I’d be willing to bet at least half of everyone thinks they can’t change their router password.
Take a string as bytes is bad with weird non-ASCII characters. Been there, been bitten in the ass by it.
At least with e-mail clients different clients on different operating systems use different encoding by default for their passwords.
With a router I could imagine different client apps following different standards.
You don’t have to take arbitrary bytes. UTF-8 encoded strings are just fine and easily handled by libraries.
At least with e-mail clients different clients on different operating systems use different encoding by default for their passwords.
The manufacturer obviously also makes the app and can control the encoding.
English letters? Really? So basically no a-z, only Æ, Þ, Ƿ, Ð?
English letters
U_w0t_M8
What have the Romans ever done for us?
Roads?
Well, yeah. Obviously the roads. I mean, the roads go without saying, don’t they? But apart from the sanitation, the aqueducts, and the roads…
Irrigation! I need to rewatch this, it’s been too long.
All right, but apart from the sanitation, the medicine, education, wine, public order, irrigation, roads, a fresh water system, and public health, what have the Romans ever done for us?
Brought peace?
Would ë qualify?
Ye olde passwarde
Also Œ, Ȝ, and arguably W and U.
Anglo-saxons got the UWU, nice
16 characters was the minimum length a password should be due to how easy it was to crack… something like a decade ago.
Now it’s something like 20 to 24 characters.
Seriously, if your company is defining maximum password length and demanding specific content, it is failing at the security game. Have the storage location accept a hashed UTF-8 string of at least 4096 bytes - or
nvarchar(max)if it’s a database field - and do a bitwise complexity calculation on the raw password as your only “minimum value” requirement.Look at how KeePass calculates password complexity, and replicate that for whatever interface you are using. Ensure that it is reasonable, such as 150-200bit complexity, and let users choose whatever they want to achieve that complexity.
It’s TPLink. Budget networking equipment comes with budget security principles.
Depending on how they do their length check, this “English only” check makes sense in a way. Non-ascii letters are a pain to validate the length of (“🏴” is seven code points and fourteen bytes long, but just one “character” to most people).
I don’t know why the max length is that low (I presume it’s stored in plaintext) but you can’t expect someone to write a good password strength algorithm from a company producing the cheapest routers imaginable.
Not allowing 20 character passwords is criminal, my bank does this.
I hate that kind of stuff, when I see this I wonder if they hash the password at all
add1more_Dopamin
