I tried for 6 months to reset my Frontier Airlines password, I contacted their support line about it. They told me to do a password reset, so I did and it said my account was locked. So the support person said “Sorry it is locked, I can’t help now, try again tomorrow but contact us before you do the reset”
So I did. Waited 2 days just to make sure 24 hours had passed, contacted support, told them about the problem, they told me to do the password reset. So I did the password reset, account locked again. Their response "Sorry your account is locked, contact us again in 24 hours about this.
So I did. Waited 2 days just to make sure 24 hours had passed. Contact support, had them verify the account is current NOT locked. Which it wasn’t, so they told me to do the password reset, account is locked. Their response “Sorry your account is now locked, contact us again in 24 hours.”
Eventually I did realize what the problem was, which is kind of my fault, but the fact my 4 attempts to contact their support directly about this problem didn’t trigger some kind of “Maybe this is an issue I could bring up to the dev team” is kind of surprising. The issue is that if you try to reset your Frontier Airlines password with a password that is too long, say 20 characters instead of 16 (max), it just locks your account. No errors given on “sorry this doesn’t meet our requirements” just locked. CS tried nothing to look into it, just it says locked now, not our problem.
I think I agree, but short passwords like “x”, “69”, “420”, “abcd”, “12345” etc. would take a very short time to brute-force… Is your take that even if these are allowed, it will make all other passwords of the site more secure, since it adds more possibilities to the list where nothing can be disregarded when trying to brute-force any other password?
Yes that’s exactly it. When you reduce the total space of possible passwords you are giving a brute force attack unnecessary hints to improve their attempts with. A weak password will always be a weak password, so single digits or obvious or popular patterns should be avoided, but this should be a matter of user education rather than a hard and fast rule for account creation.
I tried for 6 months to reset my Frontier Airlines password, I contacted their support line about it. They told me to do a password reset, so I did and it said my account was locked. So the support person said “Sorry it is locked, I can’t help now, try again tomorrow but contact us before you do the reset”
So I did. Waited 2 days just to make sure 24 hours had passed, contacted support, told them about the problem, they told me to do the password reset. So I did the password reset, account locked again. Their response "Sorry your account is locked, contact us again in 24 hours about this.
So I did. Waited 2 days just to make sure 24 hours had passed. Contact support, had them verify the account is current NOT locked. Which it wasn’t, so they told me to do the password reset, account is locked. Their response “Sorry your account is now locked, contact us again in 24 hours.”
Eventually I did realize what the problem was, which is kind of my fault, but the fact my 4 attempts to contact their support directly about this problem didn’t trigger some kind of “Maybe this is an issue I could bring up to the dev team” is kind of surprising. The issue is that if you try to reset your Frontier Airlines password with a password that is too long, say 20 characters instead of 16 (max), it just locks your account. No errors given on “sorry this doesn’t meet our requirements” just locked. CS tried nothing to look into it, just it says locked now, not our problem.
Limiting the length of a password (at least to something as low as 16 characters) sounds like an unnecessary, bad idea…
Placing any restrictions at all on what makes a valid password is an unnecessary, bad idea.
I think I agree, but short passwords like “x”, “69”, “420”, “abcd”, “12345” etc. would take a very short time to brute-force… Is your take that even if these are allowed, it will make all other passwords of the site more secure, since it adds more possibilities to the list where nothing can be disregarded when trying to brute-force any other password?
Yes that’s exactly it. When you reduce the total space of possible passwords you are giving a brute force attack unnecessary hints to improve their attempts with. A weak password will always be a weak password, so single digits or obvious or popular patterns should be avoided, but this should be a matter of user education rather than a hard and fast rule for account creation.