AOL's Embarassing Password Woes

An anonymous reader writes "AOL.com users may think they have up to sixteen characters to use as a password, but they'd be wrong, thanks to this security artifact detailed by The Washington Post's Security Fix blog: "Well, it turns out that when someone signs up for an AOL.com account, the user appears to be allowed to enter up to a 16-character password. AOL's system, however, doesn't read past the first eight characters." This means that a user who uses "password123" or any other obvious eight-character password with random numbers on the end is in effect using just that lame eight-character password."

Ahh fixed the summary...

[The Living Fractal]

Well, it turns out that when someone signs up for an AOL.com account, the user has sold their digital soul to Satan.

I *still* cringe to this day when someone asks for computer help and it starts out with "Well, when I log on to my AOL..."

TLF

Luggage...

[Anonymous Coward]

"password123"

That's the same password I use on my luggage!

I guess this means that AOL has gone from "sucks" to "blows"?

Re:Even better

[Anonymous Coward]

> It's the same thing with msn messenger. sign up with a really
> long password, and you're locked out.

But surely that's a good thing?

Re:That's YOUR password?

[Jim Hall]

That's ok, I logged in and changed it for you. :-)

Re:Same as in Linux

[ettlz]

still a strong password (eg: *_Jilt3d)

Trying to tell us something?

Re:Standard crypt problem

[dohzer]

My recipe for hash definitely uses salt.

http://www.mspong.org/cyclopedia/cookery.html#hash ed_beef [mspong.org]

Mitch Hedberg

[Himring]

Reminds me of that Mitch Hedberg joke:

"You know when a company wants to use letters in their phone number, but often they'll use too many letters? 'Call 1-800-I-Really-Enjoy-Brand-New-Carpeting.' Too many letters, man, must I dial them all? 'Hello? Hold on, man, I'm only on "Enjoy." How did you know I was calling? You're good, I can see why they hired you!'"

RIP Mitch

Re:Spelling

[Hebbinator]

Gotta get a spell check.

I spent all day yesterday giggling at "eLfavirenz" (its efavirenz- no L). While HIV/AIDS is far from a humorous disease, images of brazilian midgets with big ears and curl-toed shoes sneaking around with big bottles of pirated protease inhibitors kept jumping in my head.

For a second treat, google ELFavirenz and see the 260+ web sites that took the exact same text and put it up after /.'s error!

Re:Same as in Linux

[Anonymous Coward]

Well, a strong 8 char password cannot be "relying on the part after the eighth character to make it strong", as it only has 8 characters.

Re:No way.

[Rakishi]

Under the keyboard? That's a rarity, mostly they seem to be stuck to the monitor.