Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

So far https://studentaid.gov/ is the worst I've come across (I don't want to enter fake info^ and I can't duplicate my account to double check the requirements). From memory it was something like:

1) No words! 2) Can't reuse last 24 passwords 3) Excludes some special characters 4) 5 Security questions 5-10) Several other password requirements

Are the security questions case sensitive? Who knows.

^ "I understand that I’ll be required to certify that the information I provide to create an account is true and correct and that I’m the individual I claim to be. If I’m not the person I claim to be, I understand that I’m not authorized to proceed and that I should exit this form now. If I provide false or misleading information, I understand that I might be subject to a fine, prison time, or both."



Hopefully "Fakename Q Notarealperson" won't get me arrested… Here's the password help message:

---

Your password must be 8 to 30 characters in length and must contain at least one uppercase letter, one lowercase letter, and one number.

Your password is case-sensitive.

You can’t use personal identifiers such as your first or last name, date of birth, or Social Security number in your password.

---

Here are some error codes the API returns:

  ["NULL_USERNAME", "NULL_EMAIL", "PWD_ILLEGAL_CHARACTERS", "PWD_CONTAINS_SPACE", "NULL_CHALLENGE_QAS"]
The UI doesn't expose the password error codes. It just says “You entered an invalid response. For more info, select the help (?) icon.” (The NULL_USERNAME and NULL_EMAIL errors seem to be spurious in this context.)


Reminds me when my daughter made her Roblox account. They had some rule "don't use your real name" but they never asked her for her real name, so couldn't validate. They would arbitrarily fail a lot of chosen usernames that were made up fake names.

When she tried a variation of "Taylor Swift" it worked fine.


So I had to guess that spaces weren't allowed?


Hmm I just made an account two days ago and it told me no words allowed in the own. The email link they sent me to sign up no longer works, so maybe they changed something?


thank god it returns error codes.

i hate apis that only return strings meant for UI display only.


If only the UI did display anything useful here too!


> If I provide false or misleading information, I understand that I might be subject to a fine, prison time, or both

Enter your password wrong and you're off to jail?


Might, not will.


Stud3ntA1d24 here we come!




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: