When I sigend up for a service by DHL (German parcel delivery service), they had the strangest password guideline I have seen so far:
- At least 8 characters but no more than 13.
- Only usage of “valid” characters. The given characters did not include
\which are the things I would try to use in a SQL-injection first.
- At least one uppercase and lowercase letter.
- A digit, but not at the beginning.
Why would one ban a digit as the first character? In a perfect world, they would salt and hash the password using
scrypt and all those restrictions on the upper bound of entropy could be easily lifted. Apparently they have a weak storage system like
VARCHAR(13) or a sad mix of legacy code and cargo cult management.
I still cannot get my head around the rule about the digit not appearing at the beginning of the password. Why would one do that? The only thing I can think about is that PHP evaluates the expression
"1Test" == 1 to true. Otherwise identifiers in programming languages also must not start with a digit. Perhaps this is the origin of the “valid charcters”?
Can one guess what DHL is doing in the backend?