General : My Virgin Media Password Change

[GrimUpNorth]

Originally Posted by Sephiroth

So, people with compliant passwords don't get the request? Right?

Ours was 10 characters long starting with a letter so was compliant. Seems stupid that you're made to change it, then are allowed to change it back as soon as you log in.

Cheers

Grim

[Skie]

Originally Posted by BenMcr

Yes that is my understanding for the current prompts

If VM know that you password isn't compliant, then they are probably storing the existing passwords insecurely. Joy.

Originally Posted by Virgin

Your password needs to be between 8 and 10 characters long, with no spaces, and must contain only numbers and letters. The first character must be a letter.

Yeah, that isn't exactly secure either. Every password will now be 8-10 characters long, only contain letters or numbers and will always start with a letter. That massively reduces the number of combinations possible.

Virgin =

[BenMcr]

Originally Posted by Skie

If VM know that you password isn't compliant, then they are probably storing the existing passwords insecurely. Joy.

By compliant, I mean those that are less than 8 characters, as the minimum password length was increased back in May

[Skie]

Originally Posted by GrimUpNorth

Ours was 10 characters long starting with a letter so was compliant. Seems stupid that you're made to change it, then are allowed to change it back as soon as you log in.

Ahh, seems like they do seed them properly then. Which means they dont know what your password is, so they have to force you to change it anyway.

[qasdfdsaq]

Then how would they selectively only make non-compliant passwords be changed?

[Milambar]

Originally Posted by qasdfdsaq

Then how would they selectively only make non-compliant passwords be changed?

Agreed, this one fact means that VM are playing the "Security Theatre" game. Just trying to make it SEEM more secure, when its actually less secure. The fact that they know which passwords are non-compliant, means that either the passwords are stored plaintext, or using a reversible encryption method.

Also time limting passwords is a fail idea too, due to human nature. Good idea in theory, but fails miserably in practice, because it forces people to think up a new password every x days, which means they tend to think up easy to remember words, capitalize the first letter (or last), replace some of the letters with numbers, and toss in a special symbol such as $ instead of s. Then they write it down on a post-it note. Which defeats the whole objective.

Best enforce a totally random password, but let them keep it indefinitely, so they get used to it, and don't need to write it down.

[RB2004]

They have also added another app called my broadband usage under my apps

[arcimedes]

Originally Posted by RB2004

They have also added another app called my broadband usage under my apps

And of course when you click on the link it doesnt work

[BenMcr]

Originally Posted by RB2004

They have also added another app called my broadband usage under my apps

Originally Posted by arcimedes

And of course when you click on the link it doesnt work

That's because that shouldn't be showing up yet.

[offmore]

Originally Posted by Skie

Ahh, seems like they do seed them properly then. Which means they dont know what your password is, so they have to force you to change it anyway.

i had the same come and put exactly same password in as i had only just recently changed it and nothing came up to say i had done that

[Skie]

Originally Posted by qasdfdsaq

Then how would they selectively only make non-compliant passwords be changed?

They aren't.

They are forcing everyone to change from their previous passwords to now use an insecure password schema, even if the current password met the new criteria.

It may be that they are just aligning everyone onto an existing schema, in which case they can use the password set date or account creation date to tell if it would have been compliant or not.

A 7 character alphanumeric password (7 because we know the first will always be a letter) can have every possible combination generated in 4 hours by a modern desktop. Food for thought

Also just noticed that there are plenty of words it wont allow. Virginsuck is one :p

Also just found an easy way to avoid having to change your password. I have my old telewest one memorized and am blinking well keeping it

[Gary L]

What's with not being able to login with the original password that's always worked. and then going through the process of changing it to the same one that stopped working. and it starts working again?

madness.

[Skie]

Originally Posted by Gary L

What's with not being able to login with the original password that's always worked. and then going through the process of changing it to the same one that stopped working. and it starts working again?

madness.

It's actually a good thing.

If VM could tell if your current password already met the new requirements, then it would mean your password was being stored in plain text (or in an easily reversible format). The fact that they are having to force everyone to change their password shows that they (probably) are storing them in a way that is not reversible.

[qasdfdsaq]

Originally Posted by Skie

The fact that they are having to force everyone to change their password shows that they (probably) are storing them in a way that is not reversible.

But they are NOT forcing everyone. Only certain people.

[Sephiroth]

Me too.