One reason passwords are a nightmare – everys site has different requirements

by AMagill

Why your password can’t have symbols—or be longer than 16 characters
[Via Ars Technica]

The password creation process on different websites can be a bit like visiting foreign countries with unfamiliar social customs. This one requires eight characters; that one lets you have up to 64. This one allows letters and numbers only; that one allows hyphens. This one allows underscores; that one allows @#$&%, but not ^*()[]!—and heaven forbid you try to put a period in there. Sometimes passwords must have a number and at least one capital letter, but no, don’t start the password with the number—what do you think this is, Lord of the Flies?

You can’t get very far on any site today without making a password-protected account for it. Using the same password for everything is bad practice, so new emphasis has emerged on passwords that are easy to remember. Sentences or phrases of even very simple words have surfaced as a practical approach to this problem. As Thomas Baekdal wrote back in 2007, a password that’s just a series of words can be “both highly secure and user-friendly.” But this scheme, as well as other password design tropes like using symbols for complexity, does not pass muster at many sites that specify an upper limit for password length.

Most sites seem to have their own particular password bugaboos, but it’s rarely, if ever, clear why we can’t create passwords as long or short or as varied or simple as we want. (Well, the argument against short and simple is concrete, but the others are not immediately clear). Regardless of the password generation scheme, there can be a problem with it: a multi-word passphrase is too long and has no symbols; a gibberish password is too short, and what’s the % doing in there?

[More]

Imagine a house where every door required a different key, some used retinal scans, some used simple latches, some were made of metal and some were made of wood.

Now how would you feel if the door that led to your safe was made of wood with a small padlock on it? That is kind of what Schwab is – more than 6 and less than 8 characters. I was shocked.

It is frustrating to have to use so many different passwords at so many different sites because of the stupid, not sensical decisions. One site is fine with @ and the next one is not. One requires a number but no special characters.

One has to be longer than 8 but less than 16.

Maybe one day we ill have a more standard approach.