4

I had to change my ebay.com password today and, to my surprise, I was not allowed to use certain characters. For example [ results in an 'invalid' password and the system refuses to accept it.

Is there any sane reason for enforcing rules like this? Or is it just stupidity on their side?

Is this a sign that ebay uses some strange password storage method other than hashing it?

|improve this question
  • 1
    [ is a valid character and can be used in ebay passwords. You likely got the invalid response for other reasons (for example, a password must contain a symbol). – tim Feb 29 '16 at 10:03
  • @tim not the best example, because [ is a symbol. But I can confirm that Ebay lets me use [ in my password. – Dan Getz Feb 29 '16 at 15:37
  • @Antonio what exactly led you to believe it was the [ in your password that caused it to be rejected? Were you just guessing at why it said "invalid", or was there some indication that it was truly the [ that caused it? (I guess what I'm saying is, could you add some more details, considering other people can't reproduce what you saw?) – Dan Getz Feb 29 '16 at 15:41
  • @DanGetz true, I should have phrased it better. A password must contain one of the following symbols: (!@#$%^*-_+=). – tim Feb 29 '16 at 15:43
  • @tim oh interesting. Yes that could explain what happened, if the [ was the only symbol in Antonio's password, but Ebay doesn't recognize it as a symbol. Sounds like a sloppy oversight? I can't imagine a real reason to only count the symbols that correspond to Shift+number on an American keyboard. – Dan Getz Feb 29 '16 at 15:45
7

Is there any sane reason for enforcing rules like this? Or is it just stupidity on their side?

Not really it's just regular input validation. Probably they made a list of characters commonly used in XSS or SQL injection attacks and blacklisted those.

Is this a sign that ebay uses some strange password storage method other than hashing it?

Not really.

|improve this answer
  • They have always seemed against the use of password managers too for some reason, as they wouldn't let you paste passwords in (though this may have changed recently) – Stu W Feb 29 '16 at 11:11
  • @StuW not pasting passwords may be to discourage users from putting passwords in insecure clipboard – Neil Smithline Feb 29 '16 at 15:10
  • @StuW I doubt that that is true. Keepass has a feature that creates a random bunch of keypresses to type the password. Will ebay detect that? (And you can use this method by pressing CTRL + V on an account, and Keepass will auto-type it for you!) – Ismael Miguel Feb 29 '16 at 15:16
  • I am aware of the typing function - though it does seem odd that they would make you jump through lots of hoops, and you probably have other more pressing problems if your clipboard is being read by malicious software installed on your machine. see superuser.com/questions/936722/… for more details – Stu W Feb 29 '16 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.