Here is the text of the NIST sp800-63b Digital Identity Guidelines.

  • catloaf@lemm.ee
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    The weirdest one I found was a site that would only check to see if what you entered started with the correct password. So if your password was hunter2 and you tried hunter246, it would let you in.

    Which means not only were they storing the password, but they had to go out of their way to use the wrong kind of string comparison.