Ultra super secure invalid passphrases

Internet

I still use Twofish on a pool of pseudo-random entropic fun to generate long ASCII filled passphrases with alphanumeric characters, punctuation and such. Most sites today behave properly, but it still trips up a few.

WordPress:

ERROR: Passwords may not contain the character “\”.

Fastmail:

Too long: Use at most 50 characters

Signing up to Quantcast:

Password must be less than 50 characters long.

Dashzen… doesn’t show anything.

But the winner is the NSW OneGov site:

The characters Spaces, @, ‘, ?, +, : are not allowed

There may be some data sanitising going on here, or an attempt to reduce support queries from people forgetting increasingly longer passphrases. Still, there’s absolutely no technical reason why a site in 2014 can’t salt and hash exactly what you give it.

Author bio and support

Me!

Ruben Schade is a technical writer and IaaS engineer in Sydney, Australia who refers to himself in the third person in bios. Wait, not BIOS… my brain should be EFI by now.

The site is powered by Hugo, FreeBSD, and OpenZFS on OrionVM, everyone’s favourite cloud infrastructure provider.

You can leave me a comment by contacting me, and I might publish your thoughts. Please read the FAQs first though.

If you found this post helpful or entertaining, you can shout me a coffee or buy some silly merch. Thanks!