I think for a lot of people they are already mostly gone.

@JaredBusch said:

Of course once an attacker is in your system, they will have access to all your stuff.

Indeed. The moral of this story is simply that all bets are off if your systems are compromised.

A lot of places restrict the allowed characters because they're morons who don't understand SQL injection and think it's a way to avoid it. Ideally any character should be allowed that can be transferred over HTTP without breaking the hell out of things, which is everything which can be properly encoded.

I do trim passwords though, something old school jackasses think is bad, because after all, if there's a space at the beginning or end of a password, or a newline/return character, it must be on purpose, despite the fact that 99.9999999999% of the time it's because someone copy/pasted the password from an email or something and accidentally added on the space/\r/\n. Of course you can make the argument of never sending a password in an email (and we don't), but tell that to users who will do it all day long.

I also wrote a method to deal with "easy" passwords, things like repeating words, pattern recognition for phone numbers, birthdates, etc.

@Dashrender said:

That's definitely different than other trusted sources lead me to understand.

Check your sources. Are they quoting the laundry list of 2013 (this article was 2014) references to the opposite being true? Looks like there was reason to believe it in 2013, but nothing substantial, so everyone repeated it. But it got put to the test in 2014 and proved to not be what people had been saying.

@scottalanmiller Social engineering is a great way to get what you want. Buffer overflows, unescaped SQL queries can be patched, people wanting to be "helpful" is an aspect of our culture and I imagine only by hiring the most irritating, least helpful people on the planet can you begin to really secure yourself against your own employees.

@scottalanmiller said:

Was doing some research on this recently and found the HP documentation on how to do this:

HP Proliant Servers - How to Reset the HP ILO Inband Root/Administrator Password in Linux

It is very useful (if you have Linux running on the box in some form, or vSphere which is similar enough.) However, it turns out that some ILO firmware editions don't work with this and cannot be reset without being patched first. Important to know.

Thanks for the heads up.