prevents me from logging into Vanguard
A user discovered that a 20-character limit on Vanguard's password reset form caused login failures for users with longer passwords. The system truncated the password during the reset process, leading to a mismatch when the user attempted to log in with their full password.
Why it matters
This highlights a common but critical security and UX flaw in web development where input validation constraints create functional errors for users with high-security password practices.
For the longest time, I couldn't login to my Vanguard account through web.
I reset the password maybe 3 times during the past year, and it still didn't work. I didn't have time to think about it more, so I assumed there was a glitch. I'd just login by scanning the QR code with the Vanguard app on my phone.
Eventually, I've decided to spend some time figuring out, and maxlength="20" is the root cause. Let me explain.
Vanguard has the reset password form where <input type="password"> sets its maxlength to be 20 .
I am using 1password with a heightened sense of security. Of course, my generated password is longer than 20 characters. I would copy the password and paste it in the password input field.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in