13

When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far:

  • At least 8 characters but no more than 13.
  • Only usage of “valid” characters. The given characters did not include ' or " or ; or \ which are the things I would try to use in a SQL-injection first.
  • At least one uppercase and lowercase letter.
  • A digit, but not at the beginning.

Why would one ban a digit as the first character? In a perfect world, they would salt and hash the password using bcrypt or scrypt and all those restrictions on the upper bound of entropy could be easily lifted. Apparently they have a weak storage system like VARCHAR(13) or a sad mix of legacy code and cargo cult management.

I still cannot get my head around the rule about the digit not appearing at the beginning of the password. Why would one do that? The only thing I can think about is that PHP evaluates the expression "1Test" == 1 to true. Otherwise identifiers in programming languages also must not start with a digit. Perhaps this is the origin of the “valid charcters”?

Can one guess what DHL is doing in the backend?

  • a) No hash, and b) Simply no idea what they are doing for what reason. IT in Germany is in a sad state. – deviantfan Mar 19 '16 at 20:17
  • 1
    The lack of a hash is what I fear. Regarding the state of IT: Good luck that our minister of internal affairs want to make Germany “encryption world leader”, whatever that means … – Martin Ueding Mar 19 '16 at 20:21
  • Do you have an URL for this site? – Neil Smithline Mar 19 '16 at 21:04
  • @NeilSmithline Main site dhl.de/de.html, has a login box with registration link somewhere in the left navigation bar, leads to dhl.de/de/paket/pakete-empfangen/packstation/anmelden.html (with another redirect) . The left part is the registration. Hovering over the "?" right of the password field displays this rules. – deviantfan Mar 19 '16 at 21:46
  • Aside from the possibility of not having a leading numeral to trigger his "1Test" == 1 example is there another reason you have came to the conclusion they might not hash? It would seem if an attacker sent a 1 as an int or a true as a boolean for his password it would be easy to deter by casting the input as a string by doing "1Test" == (string)1 or $dbvalue == (string)$input. If the programmer at least caught the expression vulnerability you would think he would be smart enough to just ensure the input is a string. It would also be considerably less work. – Bacon Brad Mar 22 '16 at 5:08
4

Is it possible that you're over thinking it and they are just trying to weed out a lot of common easy-to-guess passwords?

  • It could be that. But if they would really care for strong passwords, they could just explicitly check against the common passwords using a list? – Martin Ueding Mar 20 '16 at 8:04
  • @MartinUeding Lists won't catch everything especially as a "1" in front of "password" would already break the list. – SEJPM Mar 20 '16 at 9:54
2

I think you are quite spot on in your own analysis.

The length requirement makes it almost certain that the backend stores the passwords without hashing them. That could mean that when processing the password in the code, there is a risk that the password is evaluated somewhere. As you point out yourself, PHP will evaluate "1Test" == 1 to true, causing all kinds of problems with a password starting with a number.

I can not see any other reason, though there can of course be any number of special cases with the specific code running on the site.

These kind of requirements are usually a sign of bad password storage and handling.

0

The only thing that I can think of is the following. Many programming languages prohibit numbers at the beginning of variable names. It is possible they are making a variable name out of the password. But that would be a very strange back-end choice!

  • 1
    Seems they allow symbols so this can't be it's – Neil Smithline Mar 20 '16 at 4:59
  • 1
    Hi. I'm not quite sure I can understand how this is relevant. Could you explain it for me, please? – Mark Buffalo Mar 21 '16 at 2:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.