Timeline for Is the NHS wrong about passwords?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 24, 2023 at 15:12 | comment | added | Steven the Easily Amused | I find the whole discussion amusing because the first time I logged into a "myhealth" online app, I used a password generator to generate a RANDOM 28 character password. The app complained about some of the special characters so I customized the password to remove some of those disallowed characters. The password then shrank from 28 characters to 21 characters. Logout, then later try to login and it told me my username and/or password were invalid. The change password function allowed up to 50 characters, but they only stored 18 of them and they did NOT truncate my login input! | |
| Oct 17, 2016 at 8:25 | comment | added | Robin Winslow | Isolated sightings of IE6, rare though it may be, are hardly surprising in any context. | |
| Oct 14, 2016 at 10:39 | comment | added | Peter Taylor | It's certainly true that healthcare environments can be very slow to upgrade. In 2014 I was still seeing IE6 in web server logs for a healthcare-related web app. | |
| Oct 11, 2016 at 2:00 | comment | added | Jander | Edited again. I think I've made the answer relate better to the core question. | |
| Oct 11, 2016 at 1:58 | history | edited | Jander | CC BY-SA 3.0 |
Expand answer to better relate to the core question
|
| Oct 10, 2016 at 20:02 | comment | added | Robin Winslow | That's very interesting. But one crappy Microsoft security protocol that most people aren't using is not enough to justify the 7 characters as a general rule. | |
| Oct 10, 2016 at 18:01 | comment | added | PwdRsch | @Jander I think we're mixing discussions of the authentication protocols and the hashing methods. | |
| Oct 10, 2016 at 17:05 | comment | added | Jander | NTLM version 1 does use the process I'm talking about, which it inherited from LANMAN. See e.g. Wikipedia and MSDN. NTLMv2 is the one that fixes this issue by switching to an MD4-based schema. Good point on the conversion to uppercase. | |
| Oct 9, 2016 at 19:38 | comment | added | PwdRsch | The NTLM hashing process does not split the password into two 7-character segments before hashing. You're thinking of the LM hashing process, which does indeed do this. LM also converts all alphabetic characters to uppercase before hashing. | |
| Oct 8, 2016 at 19:22 | comment | added | Jander | @MarchHo: I think you might have just solved the puzzle! Updated my answer. | |
| Oct 8, 2016 at 19:21 | history | edited | Jander | CC BY-SA 3.0 |
@MarchHo probably solved the puzzle.
|
| Oct 8, 2016 at 13:00 | comment | added | March Ho | NTLM also splits the 14-character password into two 7-character hashes, so the effective password length is 7. | |
| Oct 8, 2016 at 7:40 | history | answered | Jander | CC BY-SA 3.0 |