Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of restrictions:
Note your password:
- must be between 6 and 12 characters
- must not contain spaces, special/international characters
- must not contain your user name, first name or last name
- is case-sensitive
- should contain at least 1 number and 1 letter
I can understand minimum 6 characters, not allowing parts of your name, being case-sensitive, and needing at least 1 number and letter. The part I don't get is restricting your choice of characters you can use, and having an upper bound.
Why do websites do this? The only thing I can think of it they don't know the basics of hashing a password, which would secure it better than anything, and get rid of any security concerns.
If I choose to type
DELETE FROM users WHERE 1=1 as my password, I should be allowed to. PHP's MD5 hash of it becomes
fe5d54132b51b7d65ab89b739b600b4b which I don't think will harm anything.