Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I had to change my ebay.com password today and, to my surprise, I was not allowed to use certain characters. For example [ results in an 'invalid' password and the system refuses to accept it.
Is there any sane reason for enforcing rules like this? Or is it just stupidity on their side?
Is this a sign that ebay uses some strange password storage method other than hashing it?
Is there any sane reason for enforcing rules like this? Or is it just stupidity on their side?
Not really it's just regular input validation. Probably they made a list of characters commonly used in XSS or SQL injection attacks and blacklisted those.
Is this a sign that ebay uses some strange password storage method other than hashing it?
Not really.
[is a valid character and can be used in ebay passwords. You likely got theinvalidresponse for other reasons (for example, a password must contain a symbol). – tim Feb 29 '16 at 10:03[is a symbol. But I can confirm that Ebay lets me use[in my password. – Dan Getz Feb 29 '16 at 15:37[in your password that caused it to be rejected? Were you just guessing at why it said "invalid", or was there some indication that it was truly the[that caused it? (I guess what I'm saying is, could you add some more details, considering other people can't reproduce what you saw?) – Dan Getz Feb 29 '16 at 15:41(!@#$%^*-_+=). – tim Feb 29 '16 at 15:43[was the only symbol in Antonio's password, but Ebay doesn't recognize it as a symbol. Sounds like a sloppy oversight? I can't imagine a real reason to only count the symbols that correspond to Shift+number on an American keyboard. – Dan Getz Feb 29 '16 at 15:45