Monday Sep 18, 2006


This morning I log on to check on my ESPP- not to see how its doing, but to see *if* its doing at all. A colleague reported having troubles with the account or his site, so I thought I'd check it out and see if it was just him or everyone. The system Sun uses for this is Benefit Access from Smith Barney, apparently part of Citigroup. And they're morons.

First thing the site does is punt me to a pop up asking me to change my password, as it hasn't changed in (a mere) 90 days, and they want to make sure things stay secure yada yada. Whatever, sure- 90 days is a bit aggressive, but I'll play along... So when I try to change my password... for a secure site... that handles financial transactions... IT REJECTS SPECIAL CHARACTERS IN THE PASSWORD! No justification for it, it just outright rejects anything non-alphanumeric in the password.

Thats just swell. Thanks for looking after the security of my data, Smith Barney.
Comments:

Special characters? Some are difficult to enter correctly or at all on all platforms where you might find yourself typing them in. Think of control characters, like ^U, or ^S, or ^C, etc... Limiting passwords to printable alphanumeric ASCII is not a bad idea for a website operator, though it is a bad idea for protocol designers/implementors.

Posted by Nico on September 18, 2006 at 04:36 PM PDT #

The end of the post details what I mean by special characters, namely it barfs on "anything non-alphanumeric". Many sites *force* you to do just the opposite, and include something more than just alphanumeric- for good reason. S.B./Citi must be run by a bunch of monkeys.

Posted by rama on September 18, 2006 at 04:58 PM PDT #

Post a Comment:
  • HTML Syntax: NOT allowed