{"id":2302,"date":"2018-11-01T19:50:10","date_gmt":"2018-11-01T19:50:10","guid":{"rendered":"https:\/\/andyjohnson.uk\/?p=2302"},"modified":"2019-01-10T12:20:01","modified_gmt":"2019-01-10T12:20:01","slug":"passwords-ux","status":"publish","type":"post","link":"https:\/\/andyjohnson.uk\/blog\/2018\/11\/01\/passwords-ux\/","title":{"rendered":"Passwords UX"},"content":{"rendered":"

I’ve just been through the process of claiming a tax refund. To do this I first had to create\u00a0 something called a Government Gateway Account<\/a>. As well as giving me the slightly queasy feeling that I would now exist forever on yet another database I also, inevitably, had to create yet another password that I will henceforth have to remember. Also forever. Here’s the password creation screen:<\/p>\n

\"Government
Government Gateway Account password creation screen<\/figcaption><\/figure>\n

This does not fill me with confidence. Not at all. Not even close.<\/p>\n

Firstly the 12 character maximum length just screams “we store your password in plain text in a CHAR(12) column, so there”<\/em> at me. Like its 1993 and we’re using CGI<\/a> or something. No hashing. No salting. Just a nice text column that our legacy platform can read, and that the techs can run a SELECT on when you forget your password or they fancy a giggle.<\/p>\n

And the no special characters rule instantly activates my “we don’t do SQL injection mitigation at the backend, and we don’t care”<\/em> detector. Because the platform probably dates from before the time that anyone considered that it might be connected to the internet.<\/p>\n

Oh, and the big fat BETA at the top: I get that it’s probably meant to look exciting, but it doesn’t fill me with hope. This is my government<\/em> ID. Where’s the smartcard authentication? Can I use my Yubikey? Nah, none of that stuff.<\/p>\n

Bah. Whatever. As long as I get my refund.<\/p>\n","protected":false},"excerpt":{"rendered":"

I’ve just been through the process of claiming a tax refund. To do this I first had to create\u00a0 something called a Government Gateway Account. As well as giving me the slightly queasy feeling that I would now exist forever on yet another database I also, inevitably, had to create yet another password that I … Continue reading “Passwords UX”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-2302","post","type-post","status-publish","format-standard","hentry","category-ux"],"_links":{"self":[{"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/posts\/2302","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/comments?post=2302"}],"version-history":[{"count":2,"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/posts\/2302\/revisions"}],"predecessor-version":[{"id":2372,"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/posts\/2302\/revisions\/2372"}],"wp:attachment":[{"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/media?parent=2302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/categories?post=2302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/andyjohnson.uk\/blog\/wp-json\/wp\/v2\/tags?post=2302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}