That time a BT rep. recommended I use "something like Password123"

There are loads and loads of sites out there with ridiculous password rules, but BT gets a special shout-out for their special, multiple, password policies. In case it's not obvious no one has any business capping the length of a password or disallowing certain characters. A hash will always end up the same length and you can hash any character. Besides, once the password is hashed you don't know what characters it's made up of anyway. If nothing else BT is a technology company so really should know better.

We are moving, BT has a sale on, my wallet beat my morals and I decided to go back to BT from Andrews & Arnold.

So I got past the BT ordering page and onto the account setup page. I generated my random 20 character password as usual and pasted it into the password field, but up came a big red banner, saying "Passwords must be 8 characters long, contain only letters & numbers and need to start with a letter." (I've only just noticed that it says "be 8 characters long", at the time I read it as "at least 8 characters long".)



Note how the text is helpfully truncated. I thought this was pretty dumb but changed my password generator to use only letters and numbers, start with a letter and set the length to 40 characters. That password was accepted by the JavaScript on the page, but then I went to paste the password into the confirmation field and nothing happened. Yep, JavaScript was now preventing me from pasting my generated password into the password confirmation field. (I'm not sure if a proper password manager would have managed to do this automatically.) No problem, I fired up the browser dev tools and removed the anti-paste code.



I filled the rest of the form in and clicked "Continue". The same page loaded again, but this time with a big red warning saying "Please ensure all required information is complete."



I wasn't even sure that this was about the password, so I got onto their chat support:

Issy: Good morning Jamie
Issy: How may I assist you with your order today?
Jamie: Hi
Jamie: I am trying to create an account
Issy: I'll be happy to assist you with that
Jamie: but at the "Please complete your set up options." page
Jamie: where I choose a password etc
Jamie: it comes back with
Jamie: "Please ensure all required information is complete."
Jamie: no indication of what is wrong
Jamie: I have filled everything in
Jamie: also
Jamie: there are a number of other issues with the form
Jamie: the password rules are stupid
Jamie: and I can't paste into the password confirmation box
Issy: Please make sure your password isn't too long. Something linke Password123 should work
Jamie: HOLY FUCK
Jamie: are you joking?
Issy: Please don't use that one. It wouldn't be too safe
Jamie: can I download this chat transcript?
Issy: Please select the small envelope at the top of this chat to send a copy to yourself
Issy: You can also copy and paste
Jamie: so is twenty characters too long?
Issy: That's right
Jamie: your password policy doesn't allow special characters
Jamie: alpha numeric only
Jamie: and twenty characters is too long?
Jamie: so what's the maximum length then?
Issy: That's correct Jamie. It would need to be within 8-16 characters. I'm aware it doesn't show this on the page
Jamie: Wow.

So yes, a 16 character alpha-numeric password worked. But this isn't the end of the story. Once I had logged into the BT website I checked to see if I could change my password to a longer one, and yes, I could! In fact there didn't seem to be limit to the length, but it still didn't like special characters. But that still isn't the end of the story, while writing this blog post I wanted to see if you could create a BT account outside of the order process. You can, and on that page once you enter an invalid password there is actually a helpful description of which special characters are allowed: "Only use numbers, letters and these special characters :!@#$%^&*()_+-=[]{};':",./?". Using these I was finally able to generate a long random password with special characters.

Bonus lolz

Remember how I said I was moving? Well during the order process I ticked the box to say that I wasn't yet living at the property, but I wasn't asked for a current postal address, where they would be able to send the confirmation details.

Jamie: do you know when/where the confirmation letter will be sent?
Issy: This would be to the address your service is to be connected
Jamie: but I'm not living there at the moment
Jamie: the current owners are
Issy: You may want to make them aware to expect the letter.
Jamie: Brilliant.

ASUS Not Releasing Zenbook UX32VD In The UK?

There are quite a few reasons why I want to get an ASUS UX32VD. I currently have a UX31E, which I like a lot, but it does have its flaws, the keyboard is especially bad, and the screen is not great. With its IPS, full HD screen and improved keyboard the UX32VD should address these issues, the screen particularly has me drooling, but on top of that it has both dedicated and integrated GPUs and of course an Ivy Bridge processor and still seems a reasonable price (approximately £850). So I contacted ASUS to ask them when the UX32VD would be available in the UK. The reply surprised me, apparently they're not planning to release it in the UK at all. Having said that, several UK sites were selling the machine, so I contacted a couple. One said that they were getting in 20 at the beginning of August, but that 19 of those were already pre-ordered. After a bit of thought I put in my order but missed the last one. Not to worry they told me, they're getting in another 40 at the beginning of September. Throwing caution to the wind I pre-ordered from two online shops. On the 16 and 17 August both shops contacted me to say that the UX32VD would not be available, at all. Maybe the UK market's just too small to worry about, or maybe they're making sure they don't get burned again with old unsold stock, or maybe I'm just not being patient enough.

eBay Rule 1: Don't be a fucking idiot

I recently put a laptop up for sale on the ever more expensive eBay. A few days after the listing had started I received notification from eBay that my listing had been cancelled by them. The reason? I had specified that I would accept cash, but had not specified that buyers should not send cash through the post. What fucking idiots send cash through the post? Apart from it being absolutely bleeding obvious, it is also completely within eBay's power to warn buyers not to post cash themselves, they could put a big warning in bold red type right next to the option. I have now relisted my item with the following warning:

Please note: ebay cancelled my previous auction because I did not specify that cash should not be sent by post, so please remember not to send cash by post. Also, do not play with sharp knives, use matches/lighters near petrol, or jump off cliffs.

Problems with the Thinkpad X220 and GPT, UEFI, MBR and Legacy BIOS Booting

After several days banging my head against a brick wall and suffering the indifference of Lenovo/IBM tech support I have learnt a lot about UEFI, in regards to the X220 in particular.

1. The X220 cannot/will not boot GPT disks using Legacy BIOS. I would call this a bug.
2. The X220 will not boot /efi/*/*.efi unless "signed"(?) into BIOS, you have to copy it to /efi/boot/bootx64.efi. I guess this is a security feature, but I'm not sure how secure it is if you can bypass it so easily.
3. Disabling the BIOS setting "USB UEFI BIOS Support" disables *all* USB booting, ie, both UEFI and legacy BIOS. If this isn't a bug then
   1. it at least needs relabelling,
   2. could be moved/linked to the boot menu and
   3. is redundant as you can disable USB booting using the Boot menu.

I should say that this was with BIOS version 1.22 (I think).

I recommend following these instructions to create a very useful and versatile boot disk for diagnosis.

If you want to use the X220 UEFI boot menu I recommend disabling booting from LAN as it adds a few seconds to the boot time. You have to disable it in several places in the BIOS to avoid the wait.

See also my more general post on Arch Linux on the X220.

You Learn Something New Every Day

I think I must have been off school the day we did the beginner's Unix class. I noticed some weirdness in my apache error logs today, even weirder, the user was apparently using my own external IP address. After a bit of investigation I noticed that w3m was running on my server, on pts/5, which according to who I was on using bash. I first had to look up tty and pts. Ok, got that. Now switch screens and find pts/5, but w3m doesn't seem to be running. A helpful colleague asked if I'd tried fg, which I'd never even heard of. Turns out you can send processes to the background using ctrl-z* and bring them back with fg, would you believe it? Guess that's how people survive without screen.

* I had wondered sometimes what happened to processes went when I hit ctrl-z accidentally, doh.

Oh FFS

For a long time now I have been wondering why I can't login to my Nationwide account in linux. There's no error message, I am just returned to the login page, which isn't very helpful. This evening I decided to try a fresh firefox install. So I started firefox with -ProfileManager and created a new profile. And I could login. I don't have a lot of plugins installed, in fact the only one I could think might have any effect modifies the referer, I usually have it set to not embed the referer. It turns out the Nationwide site needs the referer. So there you go if you've been wondering about it too.

Stupidity

I received a letter from my GP practice the other day requesting that I provide proof of my address as I had yet to do so. I rang today asking if receiving the letter was proof enough. The receptionist failed to see the hilarious irony of the situation, perhaps due to having to work on the 29th December and speak to idiots ringing up and taking the piss.