8 ms·
AmEx: "We discourage the use of special characters because..."
- Hates_ 17y agoNo special characters in passwords is one of my biggest pet peeves. It really screws up my general system for generating passwords for different sites.
- derefr 17y agoYou can just "describe" your password for the special-character-impaired: #(%$^ -> hashleftparenpercentdollarcaret Probably a might bit harder to crack, too.
- jedberg 17y agoNot when they limit you to 8 characters. :)
- deleted 17y ago[deleted]
- endtime 17y agoYou use a deterministic system for generating passwords based on site? That seems only marginally better than just using the same password everwhere...unless you're doing something like using a consistent secret key to encrypt some function of the site name with AES, and using the result as your password.
- ramchip 17y agoI disagree. Just using a tiny variation, like adding the length of the website's name at the end, will be enough to defeat any automated system. Even for a human, figuring it out would require cracking several websites and a lot of brain cycles to spend on his particular account.
- endtime 17y agoWell, if he used the same strong password everywhere, it would still defeat any automated system. The reason you don't use the same password everywhere is in case someone decides to try it with your email address in a bunch of different places. If I found his password for this site was hunter2HN, I'm pretty sure I could guess his Facebook password...
- zaidf 17y agoAlmost as bad as the IRS: http://zaid.posterous.com/irs-is-not-dot-com-friendly http://zaid.posterous.com/irs-is-not-dot-com-friendly
- DrJokepu 17y agoI suppose what they mean is that keyloggers / keylogger log analyzers can spot passwords by detecting unusual sequences of special characters or improbably long non-dictionary words. I'm far from being an expert at security but sounds like a reasonable concern to me. It would be very interesting to hear the thoughts of some of the security expert HN-readers on this matter.
- memoryfault 17y agoNot to me. You shouldn't compromise the security of your entire system just to safeguard against certain keylogger scenarios.
- electromagnetic 17y agoAgreed, if you really want to prevent keyloggers simply stop online banking. That's never going to happen, so decreasing the security of your entire system is stupid.
- pierrefar 17y agoA secure password can be a correctly-capitalized and punctuated sentence. There is nothing reasonable about their concern.
- ErrantX 17y agoWell on the face of it it is a reasonable concern. But if the system has a keylogger there is very little you can do to protect your user. It is a very poor attempt at security through obscurity. If the users system is compromised there is nothing you can do. Sacrificing general security for that case is silly. The best defence to a keylogger attack is to have a secondary number vaidation alongside the password that requires you to enter a random subset of that number each time (eg 1st, 2nd, 8th).
- ghshephard 17y agoWell, to be pedantic, the best defence to a keylogger attack is a two-factor system. (RSA Fob, Smart Cards, and the like)
- cmelbye 17y agoI don't know what's scarier, their security practices, or the fact that they call the person responsible for the system a "webmaster".
- andreyf 17y agoIt seems like whoever answered this e-mail isn't a native English speaker, and so probably doesn't use the word "webmaster" the same way as you would.
- VonGuard 17y agoHoly living fuck. And this is a company that basically has encryption and security tied into its basic business. I think I might have to cancel my AmEx, cause they are obviously idiots over there.
- rdtsc 17y agoNote: they only need to have the appearance of encryption and security. When they get investigated, they can always blurt out a list of jargon word technologies they use and thus they can prove to a majority if people that they are indeed "secure". And by majority here, I mean mostly judges, attorneys and the media. Yes, this is the same "security theater" that TSA is engaged in. For example, let's say you are the customer, and someone gains access to AmEx's database of hashed passwords. All passwords are 8 characters long, so after a quick brute and dictionary attack, almost all of the accounts are cracked. Now, you along with all the customers get together and launch and class-action lawsuit. AmEx will only have to blurt out that they use: "RSA", "DSA", "128bit Encryption", "Monitoring" + many other security related jargon and that will be enough to get them of the hook. That's all AmEx needs to do. They don't have to secure your data or personal information, they only have too fool most people in case of a lawsuit that they tried to secure the information. If they have that covered, they are all set. Because almost nobody (except for HNers probably) includes security policies as the critical discriminant when shopping for credit cards, AmEx, Visa, MC and Discover others, don't really have to bother implementing any real security.
- ggruschow 17y agoI seriously doubt others are much better, so unless you're planning on withdrawing from the modern banking system, I wouldn't bother.. I met a guy who did that, and I definitely wouldn't bother with that. He ended up going off-grid too because the power company hated dealing with him and his cash so much. Well, his "eccentricity" might contributed to their opinion of him.
- mcherm 17y agoI work for a bank, and while we have our problems (http://mcherm.com/permalinks/1/password-in-pieces http://mcherm.com/permalinks/1/password-in-pieces), we aren't anywhere NEAR this bad.
- pierrefar 17y agoThat response seems to be par for the course. I phoned up my bank (HSBC in the UK) a few days ago to explain that their bank-issued Visa debit card is not secure: Verified by Visa is akin to protecting my money with a sheet of paper. Their explanation was, and I am not joking, that the system was American and so poor them can't do anything about it. Honestly, the banks don't care. They've shifted the burden of dealing with fraud onto us consumers, but gave rubbish security tools. They have no incentive to change, until a big theft happens. Even then, I doubt they'll change their ways.
- derefr 17y agoThe security in Visa, for the most part, doesn't come from protecting you from illegitimate charges happening in the first place, but rather in the fact that there's a chain of authentication so that charges can be reversed at any time, and an expert system trained on your buying habits so that you'll be alerted when you probably do need to make a reversal.
- btilly 17y agoIn the USA all potential costs from fraud go to the credit card company, not the consumer. This fact excuses a lot of stupidity, because the company bears the risk. In Britain the laws are, I understand, rather different. If your bank is providing a US based system with British liability rules, then you've got a real problem and I pity you.
- deleted 17y ago[deleted]
- ghshephard 17y agoInteresting - almost every single paragraph of this response is incorrect: <-- I would like to inform you that our website has a 128 bit encryption. With this base, passwords that comprise only of letters and alphabets create an algorithm that is difficult to crack. We discourage the use of special characters because hacking softwares can recognize them very easily. --> I don't even need to dissect the "hacking software can recognize them very easily" in this forum. They sound like they are suggesting reducing the possible keyspace is a _good_ thing. It isn't. It really, really isn't. <-- The length of the password is limited to 8 characters to reduce keyboard contact. Some softwares can decipher a password based on the information of “most common keys pressed”. --> This one is just so wrong as to make it hard to understand what they are saying. Ironically, _fewer_ keys, make it easier to guess based on the "common keys pressed (4 character passwords on Intercoms are easily guess based on "Wear") <-- Therefore, lesser keys punched in a given frame of time lessen the possibility of the password being cracked. --> Still making no sense. <-- Moreover, American Express is committed to protecting the privacy and security of all of our Cardmembers, both on-line and off-line. We believe that our current security measures, which include our sophisticated monitoring systems to detect unusual or fraudulent card activity, provide strong, ongoing protections for our Cardmembers. --> Nothing to do with passwords, and, based on the previous sentences, doesn't really inspire faith on their Sophisticated Security. I'm not saying amex doesn't have their act together, it's just not coming through in this email. <-- Rest assured, I have forwarded your comments to our webmaster for review. During this review, we may contact you if additional information is required. --> Well, at least there is hope that the "webmaster" may come to their senses.
- Alex3917 17y ago"They sound like they are suggesting reducing the possible keyspace is a _good_ thing." I disagree. If a password is lost on the user side, it's probably going to be due to a keylogger, phishing, or a trojan. Requiring short passwords doesn't make the user any more vulnerable to phishing, and it may make it harder for keyloggers or trojans to identify the password. And since the bank locks your account after three wrong guesses, there is no vulnerability from brute force attacks, especially with an RSA token. The number of people who lose their bank password from shoulder surfing or people noticing keyboard wear is probably virtually zero, so optimizing your system to prevent against these scenarios makes no sense.
- andreyf 17y agoThis seems reasonable to me. Key loggers on users' computers are probably their most common breach vector (by far), so whatever password policy minimizes that risk is probably best. You also see this in their other security policies - for example, asking a secondary password (security question) which sets a long-expiration cookie. With 128-bit SSL on the login page and a 5-guess lockout policy, there isn't much reason for strong passwords.
- deleted 17y ago[deleted]
- romland 17y agoDamn text. So hard to get sarcasm sometimes. It was, right?
- dennisgorelik 17y agoConsidering that andreyf posted original link -- yes, it was a sarcasm :-)
- vault_ 17y agoWow, that's pretty bad, but it's got nothing on one 'security' measure I ran into on an online college application site. To enumerate, the password had to: - have exactly 8 characters - contain characters from 3 of the following 4 groups -- lowercase letters -- uppercase letters -- numbers -- ? . , _ - + = $ ! – There were also some things that the password could not do: - be a dictionary word - contain any series of characters in your username All of this was enforced.
- bugs 17y agoWhen I first started school we were required to have 7-8 characters as well and the reasoning was in the faq: certain systems had not been upgraded to handle more than 8 characters which was interesting, I'm assuming it was certain computer terminals that hand't been upgraded as the restriction is now at 20 or 30 characters. But they had a similar way to increase security as your online application: Must contain 3 groups: - uppercase - lowercase - numbers inserted in between normal characters Special characters were optional but welcome.
- ErrantX 17y agoAs long as their hashing method is sufficiently slow that's not too bad a set of requirement. It at least null and voids the easiest sort of attacks. Which is not to say it is good.
- swombat 17y agoApart from requiring exactly 8 characters, the other constraints will genuinely increase security. Except, of course, that half the students will end up carrying their password on a piece of paper in their wallet.
- jdietrich 17y agoThere are about half a dozen different kinds of institutional stupidity that could lead to a response like this. I'm not sure which kind of stupid worries me most. Do they let their customer service team just make shit up? Do they train them this way? Do they really think we're that stupid? Are they really that stupid? Gah.
- mquander 17y agoWho's keeping them honest? 90% of people applying for jobs as security advisors or programmers or web developers or directors-of-logging-people-on are not going to understand about security. (I'm sure that most people would say that number is being very gracious about the quality of people applying for IT jobs, but I'm going with Sturgeon's Law to be safe.) Half of the remainder are the sort of people who won't do a good job without being cajoled into it, so unless their manager understands about security, we're out of luck. So then, if they hire one of the majority, what happens to them? Not very much. At worst, some people on Hacker News complain about it for a day or two when it becomes clear that they aren't doing their job, and they get a little bad press. At next-to-worst, someone breaks their system and commits a lot of fraud, but they can write a press release with a lot of handwaving and pretend that it's fine until it happens again. It's not as if the mainstream press is in a better position to judge the actual facts of the matter.
- timf 17y agoThere are a number of prominent financial sites with similar policies, check out this cringe-inducing rundown: http://weakpasswords.org/list/ http://weakpasswords.org/list/
- wowus 17y agoI think I hurt my palm when it hit my face.
- MikeCapone 17y agoI don't think The Onion could have come up with that email... Definitely facepalm material.
- jeffiel 17y agoFake, right?
- jacquesm 17y agoYou'd hope so. There was a guy by that name working for American Express though: http://in.linkedin.com/in/gauravsharma14 http://in.linkedin.com/in/gauravsharma14 But the timestamp on the screenshot is recent.
- by 17y agoThe same message is here in early December http://lists.eclug.net/pipermail/eclug/2009-December/008208.html http://lists.eclug.net/pipermail/eclug/2009-December/008208.... This suggests it was copy-and-pasted either inside or outside AMEX.
- amexexployee 17y agoThe reason for the character limitation is a lot more straightforward - on the backend its stored on a very legacy system (in plaintext.. but I didn't tell you that), and to increase the length of the database field would cost 7 figures.
- stgarrity 17y agowhy not just throw a hash function in the middle? technically you're not increasing the search space for a brute-force attack (but that's not the goal), but you are probably slightly increasing entropy. and most of all, you avoid bad PR like this. :) that said, it's probably still quite expensive and this PR isn't that bad.
- rms 17y agoWikileaks, dude...
- thaumaturgy 17y agoIt's COBOL, isn't it? (Not being sarcastic; that's the only system I can think of that would cost 7 figures to change a field length in the database.)
- ShabbyDoo 17y agoAt a past job, the mainframe "copybooks" required an extra digit for certain price fields (cars never used to cost > 100K). It was a months-long project which required tons of coordination with other clients systems. One could argue that the 27 other ways the company didn't have its house in order made the project costly, but the 30+ hour flatfile data conversion was an inherent part of the plan. Edit: Legacy COBOL, of course.
- gus_massa 17y agoThere is a problem with the special characters for international users. For example there are tree keyboards for Spanish: "Spanish", "Spanish Variation" and "Latin American". http://en.wikipedia.org/wiki/Keyboard_layout#Spanish_.28Spain.29.2C_aka_Spanish_.28International_sort.29 http://en.wikipedia.org/wiki/Keyboard_layout#Spanish_.28Spai... And usually, the computers are not correctly configurated, so to type the special characters you have to guess or try to remember where they are. And the problem is worse when you type a password because can not see the characters. (At work I have an "US" keyboard, but they are difficult to find here, and more expensive. At home I have a "Spanish" keyboad, but the key for typing "<" and ">" is missing, so I have to use an special keyboard driver from http://keyboards.jargon-file.org/ http://keyboards.jargon-file.org/ )
- deleted 17y ago[deleted]
- deleted 17y ago[deleted]
- leif 17y agoscreams ...so yeah, I've always been bothered by their password hogwash. I suppose I'm glad to see that they're actually as terrible as I thought they were.
- bombs 17y agoA common issue of banking websites is that they force weak passwords, but I rarely hear about banking websites being "hacked". Why?
- ramchip 17y agoThey force weak passwords for the users, not for the admin, so you could hack an account but not the website itself. Accounts also have plenty of protection besides the password: IP is logged, if it's not the usual IP my bank asks a secret question, and after 3 failed tries it locks out the account until you phone them, succeed at getting a human on the line and explain your situation. You can't brute-force much in 3 attempts.
- kmod 17y agoZipcar does the same thing: only numbers and letters. Also, try putting '<' or '>' in your password -- they'll complain about how you're putting HTML tags in your password. Now why would they worry about that?
- regularfry 17y agoOoh, that's scary. Being so worried about XSSing themselves when they look at your password and so uncertain of their HTML sanitisation that they reduce the keyspace... that's a special kind of special.
- regularfry 17y agoOoh, that's scary. Being so worried about XSSing themselves when they look at your password and so uncertain of their HTML sanitisation that they reduce the keyspace... that's a special kind of special.
- billclerico 17y agothe fact that it is minimum 6 chars and max 8 limits the size of the search field as well for brute forcing
- axod 17y agoNot really too surprising - tech support staff on the front line rarely are trained to actually have a clue what they're talking about. Just ask for a supervisor next time.
- motters 17y agoI'm not Bruce Schneier, but to me this sounds like an incredibly lame security policy. If someone asked me to write a piece of software implementing this policy, I think I would just laugh. The hypothesis that this is really because they're running very old legacy systems behind the scenes seems very plausible to me. Over a decade ago I occasionally worked with computer systems in banks and large retailers. In some cases the banks were still using computer systems for processing transactions which were more than 25 years old, and usually only one or two highly prized gurus on astronomical consultation fees knew how to run and maintain those systems.
- euroclydon 17y agoCome on! It's a website, and I'm sure it's not using Cobol Server Pages (CSP), so why now just put some simple logic between the web controllers and the COBOL logic?