13

When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far:

  • At least 8 characters but no more than 13.
  • Only usage of “valid” characters. The given characters did not include ' or " or ; or \ which are the things I would try to use in a SQL-injection first.
  • At least one uppercase and lowercase letter.
  • A digit, but not at the beginning.

Why would one ban a digit as the first character? In a perfect world, they would salt and hash the password using bcrypt or scrypt and all those restrictions on the upper bound of entropy could be easily lifted. Apparently they have a weak storage system like VARCHAR(13) or a sad mix of legacy code and cargo cult management.

I still cannot get my head around the rule about the digit not appearing at the beginning of the password. Why would one do that? The only thing I can think about is that PHP evaluates the expression "1Test" == 1 to true. Otherwise identifiers in programming languages also must not start with a digit. Perhaps this is the origin of the “valid charcters”?

Can one guess what DHL is doing in the backend?

Improve this question
7
  • a) No hash, and b) Simply no idea what they are doing for what reason. IT in Germany is in a sad state.
    – deviantfan
    Commented Mar 19, 2016 at 20:17
  • 1
    The lack of a hash is what I fear. Regarding the state of IT: Good luck that our minister of internal affairs want to make Germany “encryption world leader”, whatever that means …
    – Martin Ueding
    Commented Mar 19, 2016 at 20:21
  • Do you have an URL for this site?
    – Neil Smithline
    Commented Mar 19, 2016 at 21:04
  • @NeilSmithline Main site dhl.de/de.html, has a login box with registration link somewhere in the left navigation bar, leads to dhl.de/de/paket/pakete-empfangen/packstation/anmelden.html (with another redirect) . The left part is the registration. Hovering over the "?" right of the password field displays this rules.
    – deviantfan
    Commented Mar 19, 2016 at 21:46
  • Aside from the possibility of not having a leading numeral to trigger his "1Test" == 1 example is there another reason you have came to the conclusion they might not hash? It would seem if an attacker sent a 1 as an int or a true as a boolean for his password it would be easy to deter by casting the input as a string by doing "1Test" == (string)1 or $dbvalue == (string)$input. If the programmer at least caught the expression vulnerability you would think he would be smart enough to just ensure the input is a string. It would also be considerably less work.
    – Bacon Brad
    Commented Mar 22, 2016 at 5:08

4 Answers 4

Reset to default
4

Is it possible that you're over thinking it and they are just trying to weed out a lot of common easy-to-guess passwords?

Improve this answer
2
  • It could be that. But if they would really care for strong passwords, they could just explicitly check against the common passwords using a list?
    – Martin Ueding
    Commented Mar 20, 2016 at 8:04
  • @MartinUeding Lists won't catch everything especially as a "1" in front of "password" would already break the list.
    – SEJPM
    Commented Mar 20, 2016 at 9:54
2

I think you are quite spot on in your own analysis.

The length requirement makes it almost certain that the backend stores the passwords without hashing them. That could mean that when processing the password in the code, there is a risk that the password is evaluated somewhere. As you point out yourself, PHP will evaluate "1Test" == 1 to true, causing all kinds of problems with a password starting with a number.

I can not see any other reason, though there can of course be any number of special cases with the specific code running on the site.

These kind of requirements are usually a sign of bad password storage and handling.

Improve this answer
0

The only thing that I can think of is the following. Many programming languages prohibit numbers at the beginning of variable names. It is possible they are making a variable name out of the password. But that would be a very strange back-end choice!

Improve this answer
2
  • 1
    Seems they allow symbols so this can't be it's
    – Neil Smithline
    Commented Mar 20, 2016 at 4:59
  • 1
    Hi. I'm not quite sure I can understand how this is relevant. Could you explain it for me, please?
    – Mark Buffalo
    Commented Mar 21, 2016 at 2:10
0

If gramps writes it down on a piece of paper, a leading 0 might come across as a leading O. That is the only "motivation" of such a rule that I can think of at least.

(Now, last time I tried loggin in to a computer system, you were given more than one chance to type in passwords, but... that's another story😉)

Improve this answer

Not the answer you're looking for? Browse other questions tagged .