By far the worst is the costa rican national bank:

• Must be between 8 and 16 characters long
• Must have at least 4 letters and 4 numbers
• Can’t have consecutively repeated characters (can’t do “aa” but can do “aba”)
• Can’t have vowels or Ñ
• Must not be one of your last 6 passwords
• Must be changed every 90 days
• Also forgot that their website and app try to block password managers and copy and paste

My favorite is a major credit card company with case-insensitive passwords. They also only allow a small handful of special characters, so the total possible character space is roughly 42 characters. Needless to say, I chose to use a password that was the maximum allowed length (which was sadly also only 32 characters).

Not sure if it falls under the same category, but the way Activision handles (handled? I haven’t used them since) passwords was atrocious! I had to reset my password to get back into my account, I used a random diceware password, it accepted it. However! The client on both Windows and Xbox wouldn’t let you input a password longer than I believe 20 characters. So while you can set a 25 character password, you can go fuck yourself if you actually wanna log in…

Stupid bank app doesn’t allow password managers… and if you hit the enter button to login you get an error message informing you that you need to mouse click on the button.

My work was using some MS-based account system, but I don’t know if this was stock or something they modified. When you had to change your password, it would tell you if your new password didn’t meet the password requirements, as usual. What it wouldn’t tell you was what those requirements were…

So yeah, the requirements the system won’t tell you about would have to be the worst one i came across…

I had to log back into an account for an app (I think Taco Bell) that decided to remove passwords entirely without any notice. You typed in your email address, had to open your email account and click a link they sent you, it would open a webpage, which would then have a button to open the app again. If I remember correctly too, it would only work on Chrome, so I had to copy and paste the link since Chrome isn’t my default browser that automatically opens from my mobile email.

Besides that, I remember some website required a special character from an extremely small list and wouldn’t allow two of the same letter back-to-back.

Not so much password requirements as just a completely removed implementation:

To access payment stubs in a data center (not us) that I worked at, the user account was our public email address and the password was a personal code, sorta like SSN, but that code could be easily looked up as it was public info.

I showed the director of HR, who authorized this her own payment stub as evidence that this was baaaaadddd

So she asked me to check that system for more issues

Turns out it stored passwords in blank (wtf) and would authenticate with two queries. First query would check if the username (email) exists. Second query would check if the password exists. If both exists, you’re in! So i could login to any account with MY password…

This is a tip of a very big iceberg there

Obligatory link to neal.fun password-game

I had a wi-fi device a few years ago that would require a password up to 12 characters, but that requirement wasn’t explicitly written anywhere. The device would gladly accept a 13-character password, for example, but you would never be able to log in again (factory-resetting was the only way to undo).

More recently I purchased a Lennox HVAC system that came with their proprietary thermostat (an Android tablet with a wall mount). During the Christmas break I got myself a new wi-fi router and had to reconfigure all my wireless devices. After 2 days, the Lennox thermostat was the last device to join the new wi-fi network… and it failed because their password could have any character EXCEPT the asterisk — and my new password had an asterisk. I didn’t like the idea of redoing all my other devices AGAIN just because of this idiotic password rule, so I ended up creating a new SSID just for the thermostat. I named it LENNOXSUCKS.

Probably the silliest thing I have run into was some game. It asked you to set two passwords. You needed both to login. The second password couldn’t be changed. This is why it was secure, see. (…What.)

When I created my account and set the second password, I couldn’t log on the second time. Because I had entered a 20 character second password. It was accepted and verified during the account creation just fine. On the second login, it only accepted 16 characters. (It let you enter 20 characters but said it was too long.) Trying to enter first 16 characters of the second password didn’t work, of course.

I then contacted the support, and they did manage to reset the second password anyway. (What is this even)

Passwords that must contain a special character, but only from a list of three special characters.

Passwords that must be changed every 3 months.

Absurdly narrow length requirements, im 80% sure I saw one that required 8-16 characters.

All dictionary words were banned from being in a password regardless of length, so passphrases weren’t allowed.

The oddest I’ve ever encountered: EXACTLY 15 characters long. No more, no fewer. 15.

Honorable mention: Various online accounts where I used my password manager to generate a long, secure password, which the website accepted without warning or error. I was then locked out because their user management system could not handle such long passwords (had to create a second account with a much shorter password to find that out) 🤣

My old bank required you to have a password 12 characters long exactly, and to login you have to give the characters in specific places.

I would ask you what are the 4th, 7th, and 11th letters of your password.

Anyone want to guess why that aren’t my bank anymore?

One special character.

Seems logic right? Until you get that it is one and one only. Took me some time.

1. There was the multi user operating system in the 1990s that required every user to have a unique password. We were young and innocent then and used common English words. Upon changing your password, it would check your new password against all other users. An error like

That password is already used by johnp. Please choose another password.

was not uncommon.

2. When I started using a password manager, I got keen and changed my passwords to 64 random characters. My bank would change this to uppercase, delete special characters, and save the first 8 characters of what was left. So when I logged in, it would compare the 64 character password I entered to the converted 8 character password that they saved, and find that they were different. (I found this out when I rang and complained, and they told me my password over the phone … 😱). They don’t do that any more.