topic Re: My O2 Password Change in Discussions & Feedback

My O2 Password Change

Anonymous — Thu, 25 May 2017 11:44:52 GMT

There is a major bug with the password change service, and as "contactus" don't want to work at the moment either im posting it here.

Password complexity isn't working correctly, it is forcing me to have at least:

1 letter
1 number
1 special character

To start off with these enforced security checks are very restrictive. I never usually have a problem with at least

1 upper letter
1 lower letter
1 number

Now ok let's try a special as well. ' isn't counted as a special, neither is ! despite ! being on the list of special characters.

Please fix the password complexity rules. Instead of forcing us to have a very complex password that we are likely to forget, introduce 2 factor authentication - you have our mobile numbers anyway...

Re: My O2 Password Change

MI5 — Thu, 25 May 2017 11:57:37 GMT

@MercedesS Another one for you I think

Re: My O2 Password Change

MercedesS — Thu, 25 May 2017 13:05:38 GMT

Hello @Anonymous

We are sorry to hear about your problems when choosing a proper password but security is really important!

Just for testing, I have changed mine under My O2 website (are you using the app?) and seems to work for me even with special characters.

If it helps, The Open Web Application Security Project (OWASP) - a worldwide not-for-profit charitable organisation focused on improving the security of software- has a selection of punctuation characters that are present frequently used in passwords: Password special characters.

And thanks, we will pass your feedback on to the O2 Security team.

[Edited: more info about password security The Risk of Using Weak Passwords]

Re: My O2 Password Change

Anonymous — Thu, 25 May 2017 17:25:44 GMT

just tried it again, and it still doesn't work.

And thanks for extra info that i already know...im a software developer with a lot of security experience tyvm!!!

Edit:

its definitely a bug, if you try to change to a password with an apostrophe in it (') then the new password isn't accepted. An apostrophe is a special character...

Re: My O2 Password Change

MercedesS — Fri, 02 Jun 2017 12:00:42 GMT

Hello @Anonymous,

So you are right, when you change your password if you try to use an apostrophe (') - the new password won't be accepted. Only the punctuation on the list is allowed.

Sorry you're stuck with letters, numbers and ! ? + - * < > _

Re: My O2 Password Change

Anonymous — Fri, 02 Jun 2017 17:32:19 GMT

Thanks for looking into this, through experimenting I have found that I don't actually need a special character after all, it's just as you said, only a few special characters are supported - the rest prevent the new password from being accepted 😞

Re: My O2 Password Change

MercedesS — Mon, 05 Jun 2017 08:12:23 GMT

Sorry @Anonymous and thanks!