Bitwarden has a function where it types in (not pastes) the password and shows the prompt for it without right-click.

As a super secret dev hack may I introduce you to shift + insert a fair few sites specifically block ctrl + v instead of properly disabling the clipboard action and, of course, if you read this and then submit a Jira ticket to block shift + insert... well... h8u

Any password manager should be able to "type in" the password. Or be a browser plugin that doesn't rely on copy pasting, but use other mechanisms to inject it directly into the field.

But yes, if that's their online portal, I am not kidding I would change banks.

a previous bank used to have a max password length of 8 characters, then proudly announced that they will increase it to 32

Then I made a typo at the end of my password and it let me in anyway, and I realised they were just trimming the first 8 characters to give the illusion of security

USAA has 8-12 ONLY. My smallest memorized password algorithm is 13 characters, that I typically use for throwaways, doesn't even fit.

Bobby tables, noooooooo!

My bank uses 6 digit 'customer number' (which is set by the bank) and that's verified with an app and a personal PIN (app shows 'login attempt ABCD at mm.dd. hh:mm' where ABCD is shown on login page too) or via SMS OTP (again with 'ABCD' verification). And again with personal pin + app or OTP to confirm transactions. The app itself can be protected with a fingerprint or phone pin and every new installation needs to be registered to the system, so I can't just use my phone app to access my wifes account (or anyone elses) but I still can map multiple accounts (like corporate ones) to the same installation.

I think that's pretty reasonable approach.

Reason why I took a hardware tan generator versus using the OTP function of one of their other apps.
Thanks but no, I will use the old crusty method as I know how easy that's hacked.

Never heard of this. Where is this at? :o

wdym? What's a dynamic password?

At least it should not, in many countries must not, be the only measure.
I once encountered an OR in the requirements: Capital letters, small letters and digits OR special characters.

But wouldn't that mean the bottom checkbox should be cleared and the 2nd one should be checked?

Still doesn't make sense.

Yeah but It still states "A combination of letters, digits and special charaters"

It should then be spelled as "A combination of letters digits, and one special character"

It's like a Captcha that only lets in autistic people.

Yay!

problem is the late stages of the game the password requirements change when your password's emojis start catching fire.

Last time I got pretty deep in, but it became impossible when the chess notation rule required Cs and Ds, making it impossible to stay below the roman numberal sum limit.

I used Google lens. Got stuck afterwards on a chess rule. The captcha rule used the notation for the chess one to complicate it further haha

I got past it because it happened to throw a place from my country. And there was also a flagpole with a flag on it to really drive it home. XD

It's possible that the passwords want through an old ass cobalt system or something that forced everything to be capitalized so to solve that they made everything non case sensitive.

But even that sounds insane as the passwords should have been hashed.

At least the character limit had a technical reason behind it: having a set size for fields means your database can be more efficient.

If that is the actual technical reason behind it, that is a huge red flag. When you hash a password, the hash is a fixed size. The size of the original password does not matter, because it should not be stored anyway.

Your well come.

I miss Allie's blog alot.

Because if you disable browser autocomplete, what's obviously going to happen is that everyone will have a text file open with every single one of their passwords in so that they can copy-paste them in. So prevent that. But what happens if you prevent that is that everyone will choose terrible, weak passwords instead. Something like September2025! probably meets the 'complexity' requirement...

No we don’t.