The biggest red flag is when they try and stop you from pasting your password (or anything else for that matter) breaking password managers.

There are years-long arguments on social media with companies who do this with actual security experts telling them they’re hurting security (including referencing organisations like the UK’s National Cyber Security Centre) and their only response is “we don’t allow pasting for security reasons” but they can never explain how it helps security - because it doesn’t. It drives me mad.

"Cannot use a sequence of characters used in any previous password," or "Cannot use a previous password backwards." Those are sure fire indicators that they're storing your passwords in plain text.

I used to have a bank that had the first rule. Emphasis: Used to.

And putting an upperbound length limit on passwords is pants-on-head loony, unless the length limit is very large, like 1024 characters or something. Especially if it's going to be hashed anyway.

It's the worst when they make you solve a chess puzzle and today's wordle

Work for a hospital chain in IT and we have an application has a 1-10 character, no specials policy LOL

I forgot my password to a local government site once and they emailed me my plaintext password. Wtf.

They don't need to store previous passwords to prevent reuse, they just need to store the hashes. This is safe.

Those don't necessarily mean they're storing in plain text.

Have you played the password game yet?

https://neal.fun/password-game/

My works payroll bullshit, you mightve heard of the company, makes us change the password every so often and it can't be one we used before. I work in a warehouse driving a forklift. There are people who can barely operate the computers they installed 5+ years ago still. It's dumb af. But no one would listen to me on it so I don't even bother.

My old bank would reject passwords that didn't start with a letter. Numbers and symbols were required, but you couldn't use them as the first character for some reason. Infuriating.

Most places where I've seen those annoying rules are official websites of my country's institutions... Hard to make do without them.

Places like Flickr can go fuck themselves because they want 12-character password limits. 12! Some people can barely even remember a 6 string password much less one that's 12.

Why 12? "SECURITY!" they'd spam. I've found it more secure to have a mix of special characters, lowercase/uppercase and numbers than the longer string of a password. Just means you're going to increase the volume of people having to reset their passwords now and then because you required them to make it 12 characters long.

I don't understand why people would like 12 characters...