Bad password security requirements

[thgjerde]

Why do you make it so difficult to use strong passwords on ea.com?
Why are some characters not allowed such as comma (,) full stop (.) question mark (?) tilde (~) quotation mark (") question mark (?) space ( ) and every non-us character and emoji?
Why do you limit passwords to maximum 16 characters?

This makes it impossible to write even simple passphrases with normal punctuation that can be memorized.
Is it really that hard to do proper input sanitation to support full unicode.
I am guessing the password length limit is there because you are storing plaintext passwords in your database instead of using a one-way hash.
Please learn how to do proper password authentication from NIST Special Publication 800-63B https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

[EA_Darko · Accepted solution]

Thanks for taking the time to post your feedback @thgjerde.

Darko

[EA_Darko · Accepted solution]

Thanks for taking the time to post your feedback @thgjerde.

Darko

[digital_ice101]

At the very least, remove the upper limit on length.
The easiest way to add entropy is length, and by advertising an upper limit you're providing valuable information to brute force attacks to ignore anything longer than that.