Attention WG devs: BAD password length & validation error checking being performed at na.wargaming.net

This is a warning for security conscious "paranoids" like me looking to reset their WG master passwords.

Summary: WG's "Change master PW" screen silently truncates passwords over 60 chars and then returns a, "Success...password updated", message to the users. NO input validation is taken to prevent the entry of passwords OVER 60 chars. And NO warnings are thrown telling the user their newly changed password ISN'T THE SAME password they just entered... and has now been automatically saved to their password managers (like Bitwarden or 1Password). The result is obvious... when the player then goes to login to the website AFTER just "successfully" updating their password, multiple failed login attempts follows. WG, if the password policy stipulates a max pw length then the stupid website shouldn't allow the user to enter a 62 char password. Seems obvious, right?

Note, WG's previous master password policy only allowed a MAX of 62 alphanumeric (a-z, A-Z, 0-9). This is now reduced to 60 chars. NO special chars were previously allowed except for one... the underscore "_" . This was beyond idiotic BTW so I'm grateful for the change.

But sometime over the intervening years since I've been away, WG reduced max pw length further, by 2 chars, and expanded the PW policy to allow to allow for most special chars ($#;:@!~=^). Great! But whoever was tasked with making these code changes dropped the ball.

If you're going to limit passwords to something LESS than industry standard best practices, you need to TELL THE USER!!! You also should NEVER, NEVER, NEVER silently change or truncate user input!!! And definitely never do this to w/ passwords! This is Coding 101. Basic shit.

WG, you need to:

1. On the "Update Password" page, set an INPUT MASK limiting max length to 60 chars. Or allow the entry of >60 chars but then throw an ERROR/WARNING upon page submit!

2. You need to explicitly TELL the user all PW rules upfront in plain language. Max PW length rules are missing from the change pw rules dialog box that pops up.

3. You need to add a function to Toggle Password Visibility!! Right now the input box is SHORT, and it only displays masked passwords as a series of dots "...." The user can't count the length of their newly entered password b/c all they see are dots that overflow the short input box. If the user attempts to count characters by advancing the cursor forward, they CAN'T cuz once the cursor reaches the right edge of the input field, there's no longer any visual cues of movement as you attempt to advance the cursor forward. Are you at the end of your password or are you at the end of the input box? Who knows? The user just sees a box filled with static dots. Being able to TOGGLE password visibility solves this problem.

4. Make the physical length of the PW input field physically longer than 60 chars... goes hand-in-hand with #3. (but obviously you still need to enforce input validation)

5. You need to HARD FAIL any password change that violates password policy! You MUST STOP SILENTLY TRUNCATING long passwords and then telling users the update "succeeded". Again, this is Coding 101 shit.

6. You need to MAKE SURE any PW validations & policies sync between the 'Update Password' screen and 'Acct Log-in' screens on both the Client and Website.

Please make these basic changes and save players some grief.