4 ms·

Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8

by qb45 11y ago

Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted. Funnily, the admins apparently really cared about security very much, so they required users to change passwords every few months. It was possible to change asdfghjk to asdfghjkl and keep logging in with asdfghjk. I kid you not.

mikeash 11y ago
There is a bank which shall remain nameless (<cough>Schwab</cough>) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.
- Retric 11y ago
  As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.
  - mikeash 11y ago
    I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?
  - Estragon 11y ago
    > As long as you throttle login attempts short passwords are fine. Not if the password-hash database leaks.
    - Houshalter 11y ago
      If someone has hacked into your bank, you have bigger problems than the hackers knowing your password.
- breischl 11y ago
  Last I checked, Fidelity truncates to 10 characters, but silently converts them all to digits. They map them all to their equivalents on a typical phone keypad... so it's not even using all the digits. Talk about awful security... Edit to add: It appears they may have fixed this misfeature. I did personally verify that you could log into their website with the phone-equivalent digits at one point, maybe a year or two ago. There's also a few forum threads about it around the net, eg https://www.bogleheads.org/forum/viewtopic.php?t=93792#p1350116 https://www.bogleheads.org/forum/viewtopic.php?t=93792#p1350...

by qb45 11y ago

mikeash 11y ago

There is a bank which shall remain nameless (<cough>Schwab</cough>) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match. They say they're working on fixing it but it's taking an awfully long time.

Retric 11y ago
As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue. ~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.
- mikeash 11y ago
  I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?
- Estragon 11y ago
  > As long as you throttle login attempts short passwords are fine. Not if the password-hash database leaks.
  - Houshalter 11y ago
    If someone has hacked into your bank, you have bigger problems than the hackers knowing your password.
breischl 11y ago
Last I checked, Fidelity truncates to 10 characters, but silently converts them all to digits. They map them all to their equivalents on a typical phone keypad... so it's not even using all the digits. Talk about awful security... Edit to add: It appears they may have fixed this misfeature. I did personally verify that you could log into their website with the phone-equivalent digits at one point, maybe a year or two ago. There's also a few forum threads about it around the net, eg https://www.bogleheads.org/forum/viewtopic.php?t=93792#p1350116 https://www.bogleheads.org/forum/viewtopic.php?t=93792#p1350...