[p to the e]

Maybe this is more of a web development thing I'm trying to figure out the reasoning behind this. The only thing I can think of is it is something they inherited from Meteor and are reluctant to update. I haven't logged into my eir account in ages so I tried to reset my password and got a notice that "Password must have at least 1 letter, 1 number and length must be between 6 - 10 characters". See image attached

[denartha]

What are you asking exactly?

[p to the e]

Sorry. Is there a reason the number of characters is limited to between 6 and 10?

[denartha]

Originally Posted by p to the e

Sorry. Is there a reason the number of characters is limited to between 6 and 10?

OK. Short answer is I don't know. Perhaps due to some legacy system or hardware they are using. I did a Pen Test for them a few years ago and were still using MD5 hashes which are no longer considered secure.

[sheepsh4gger]

Originally Posted by p to the e

Maybe this is more of a web development thing I'm trying to figure out the reasoning behind this. The only thing I can think of is it is something they inherited from Meteor and are reluctant to update. I haven't logged into my eir account in ages so I tried to reset my password and got a notice that "Password must have at least 1 letter, 1 number and length must be between 6 - 10 characters". See image attached

I think 6 characters is a bad idea, it could be brute-forced. i would make it at least 12 characters.

[Nikolai Tangy Housewife]

Originally Posted by denartha

OK. Short answer is I don't know. Perhaps due to some legacy system or hardware they are using. I did a Pen Test for them a few years ago and were still using MD5 hashes which are no longer considered secure.

I’m sure you also signed an NDA before you were allowed to carry out this pen test.

[nullObjects]

Originally Posted by p to the e

Sorry. Is there a reason the number of characters is limited to between 6 and 10?

I'd guess it's possibly either a business reason that they don't want customers setting passwords they think are too complex and they will have to talk to support to reset them or else a constraint on the max number of characters that they either don't want to or are not able to easily update

[denartha]

Originally Posted by Nikolai Tangy Housewife

I’m sure you also signed an NDA before you were allowed to carry out this pen test.

Yes but it was over 5 years ago so no longer valid.