3 ms·

In 2012 I had to set up a password for BankID with DNB, (The Norwegian Bank), and used the automatically generated password "P0Q1u-A(Va,?mO?nIrBl" from KeePass.

In 2012 I had to set up a password for BankID with DNB, (The Norwegian Bank), and used the automatically generated password "P0Q1u-A(Va,?mO?nIrBl" from KeePass. Their entropy estimate showed this password as very weak and did not accept it, even though much simpler passwords were shown as "strong". I sent them an email asking them about their entropy estimation, and complained about their implementation disallowing pasting of passwords. They quickly replied that their entropy estimation was flawed in handling some characters and that they would fix this. They also said that copy/pasting was disallowed as this password should not be stored in any form. I sent them an email back arguing that this policy forces people to use weaker passwords, to which they replied that this would be taken to their product manager. Now in 2016 they've updated their implementation which allows pasting passwords, making life easier.

kkirsche 10y ago
As an avid password manager user, thank you for taking up this fight
matthewmacleod 10y ago
That's really nice. I wish that more organisations responded in that kind of way; I certainly know that if someone wrote to us to complain about password or other security issues we'd certainly take it on board. What are the reasons that such inquiries often get stonewalled - is it simple organisational complexity, and the difficulty of actually contacting the right individual?
- pveierland 10y ago
  Their response to the entropy issue (which was a clear bug) was "we confirm that today's implementation yields a somewhat incorrect error message when using some special characters in passwords and that this will be fixed". When there is a clear bug it is fairly easy internally for them, since they just need to confirm the issue and send it to the right people to get it fixed. With the copy-pasting issue, their reply simply stated that disallowing this feature was intentional policy on their part and that their passwords should not be stored in any way. Changing policy and implementation would require a greater effort on their part, and admittance that a suggested change would improve their service. I then wrote a longer reply, arguing that following their password recommendation for the ~150 online accounts I had at the time would be infeasible without a password manager, and insisted that I would like a reply which did not refer to existing policy. The response to this was that it would be taken to their product manager. If the person handling the issue didn't care about the company doing the right thing or their job, or if they were convinced that their policy was correct, or if they believed escalating would certainly not lead to change in policy, the issue may not have been escalated. So the people handling issues must care enough to escalate unresolved issues, or the company policy must force escalation of unresolved issues, and at some point in the chain of escalation some person must believe that following the suggestion would result in an improvement.

kkirsche 10y ago

As an avid password manager user, thank you for taking up this fight

matthewmacleod 10y ago

That's really nice. I wish that more organisations responded in that kind of way; I certainly know that if someone wrote to us to complain about password or other security issues we'd certainly take it on board. What are the reasons that such inquiries often get stonewalled - is it simple organisational complexity, and the difficulty of actually contacting the right individual?

pveierland 10y ago
Their response to the entropy issue (which was a clear bug) was "we confirm that today's implementation yields a somewhat incorrect error message when using some special characters in passwords and that this will be fixed". When there is a clear bug it is fairly easy internally for them, since they just need to confirm the issue and send it to the right people to get it fixed. With the copy-pasting issue, their reply simply stated that disallowing this feature was intentional policy on their part and that their passwords should not be stored in any way. Changing policy and implementation would require a greater effort on their part, and admittance that a suggested change would improve their service. I then wrote a longer reply, arguing that following their password recommendation for the ~150 online accounts I had at the time would be infeasible without a password manager, and insisted that I would like a reply which did not refer to existing policy. The response to this was that it would be taken to their product manager. If the person handling the issue didn't care about the company doing the right thing or their job, or if they were convinced that their policy was correct, or if they believed escalating would certainly not lead to change in policy, the issue may not have been escalated. So the people handling issues must care enough to escalate unresolved issues, or the company policy must force escalation of unresolved issues, and at some point in the chain of escalation some person must believe that following the suggestion would result in an improvement.