cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Super Explorer ***

Bug in QuickBooks Online Closing Password - 16 character limit is imposed without warning

There is a bug in:

 

Account and Settings->Advanced->Accounting->Close the books 

 

The overall symptom is that a previously-entered Closing date password simply does not work. For severity, I'd usually class this as Critical, however since an admin is able to remove or change the Closing date password without actually knowing what it is, I'd downgrade to merely Serious.

 

It's in the way the password is handled if the field just above Password is set to "Allow changes after viewing a warning and entering password". So, I entered a new password, and it was accepted without complaint, but it was then subsequently not accepted when I needed to use it to make a pre-close-date edit. I checked it several times with various different passwords and was able to be sure it was not entry error on my part.

 

I think I've tracked it down to the following:

 

  1. For creation purposes, the Closing date password appears to have a length limit of 16 characters
  2. If a string of greater than 16 characters is entered when creating the password, it is truncated to 16 characters
  3. That truncation occurs silently; i.e. no warning or error is provided to the user. Also, neither the length limit, nor the truncation are made clear to the user at the point of entry (nor, as far as I could find, are they documented anywhere) 
  4. The result is that a Closing password may be different from what the user reasonably believes it to be
  5. Subsequent evaluation of the Closing date password when provided to the password challenge -- i.e. while attempting a pre-close-date edit -- appears to take into consideration all characters, even those beyond the 16th character position 
  6. As a result, if the same greater-than-16-character string that was provided to create the Closing date password in the first place is then provided to the password challenge while attempting a pre-close-date edit, authentication fails.

Notes:

  1. The very attentive user may notice that the number of character masking dots that appear in the field to create the password never exceeds 16, while the number that appear in the field to enter the password on challenge can. However,  as an indicator of the fact that truncation is happening at the point of creation, the number of masking dots is neither sufficiently clear, nor even, these days, reliable
  2. The fact that on later revisiting the password creation field the number of masking dots displayed is the same as the number of characters in the password (up to a max of 16) is not good practice since it provides some information about the password to a viewer. In this case, admin authentication must already have been provided to be able to see the field, so the risk is probably low here. However, in general it may be better to use a standard number of dots after the password has been successfully entered. For example, the 1Password tool uses ten dots regardless of the length of the underlying password.

 

 

Solved
Best answer 09-25-2019

Accepted Solutions
Super Explorer ***

Re: Bug in QuickBooks Online Closing Password - 16 character limit is imposed without warning

Hi @SarahannC ,

 

I'm not looking for support on this. I was just making it known to fellow users on this forum. Of course it does seem to me quite clearly to be a bug, and so yes it might also be useful for Intuit if someone from the company who is on this forum passed on the info to someone who could act on it. But if/how/when it then got dealt with would be up to the dev team and that's not something I'd expect to hear back on. (Devs are busy folk! I know; I was one. :-) )

 

Thomas

 

View solution in original post

2 Comments
Moderator

Re: Bug in QuickBooks Online Closing Password - 16 character limit is imposed without warning

Thanks for providing further information, ThomasK.

 

It would be best to contact our Phone Support and report this so that they can investigate this further. Please follow these steps:

 

  1. Click Help (?).
  2. Click Contact us.
  3. Enter a short description of your concern ( Bug in QuickBooks Online Closing Password - 16 character limit is imposed without warning ).
  4. Then, click Let's Talk.
  5. Click Get a callback.
  6. Enter your contact information.
  7. Select Call me.

 

Just fill me in anytime if you have questions or suggestions with QuickBooks. I'll be right here.

Super Explorer ***

Re: Bug in QuickBooks Online Closing Password - 16 character limit is imposed without warning

Hi @SarahannC ,

 

I'm not looking for support on this. I was just making it known to fellow users on this forum. Of course it does seem to me quite clearly to be a bug, and so yes it might also be useful for Intuit if someone from the company who is on this forum passed on the info to someone who could act on it. But if/how/when it then got dealt with would be up to the dev team and that's not something I'd expect to hear back on. (Devs are busy folk! I know; I was one. :-) )

 

Thomas

 

View solution in original post

Need to get in touch?

Contact us