11 ms·

My bank limits passwords at 15 characters. The best thing? There is no verification, it just cuts off. Have fun figuring out why you can not login anymore.

pluma 10y ago
Fun fact PayPal (used to?) silently cut off passwords when signing up, but not when logging in. And the password rules are of course not shown on the login screen. So good luck remember what length they cut your password down to when your password manager has stored the longer version.
tssva 10y ago
Here is a fun one. My credit union limits passwords to 32 characters and since I use lastpass for my passwords I had it generate a 32 character password when registering at the website. Next day I get around to downloading and setting up their mobile app. Login and get a prompt that since it is my first time using the mobile app. They have sent me an email with a 4 digit code I need to enter before proceeding in the app. The email with the code arrives quickly and I enter the code. Proceed to get an error message "Error 400: This service is not available at this time." Ok, they must be down I'll try again later. The code is good for 24 hours. Next morning find time to try again and get the same error message except this time it also informs me that my account has been locked. Call up customer service and with scarily little information get them to unlock my account. Explain what is happening with the app and the CS rep puts me on hold. Comes back and tells me the IT folks thought it must be a problem because of my email address. "Do you have a normal email address like from Gmail, Yahoo or hotmail?" I release a great sigh and give in to the stupidity I'm about to have to navigate. I provide a gmail address. They change the email associated with my account on their end and tell me I should try again in 24 hours. I do with the same results. Call back again and the CS person puts me on hold again while she reaches out to IT. This time whoever she talks to knows the issue right away. Turns out that when you login to the mobile app for the first time and submit the code it is actually appended to the end of your password and submits it as your password. Which if you have a password with more than 28 characters means you are exceeding the 32 character password max which causes them to return the informative, "Error 400: This service it not available at this time.", message.
NoGravitas 10y ago
When I was doing my taxes 2 years ago, I got bitten by the H&R Block website doing that. It did not inspire the trust.
Bartweiss 10y ago
And this from the same industry that pretends showing me a picture of a squirrel as a "secret image" meaningfully enhances my security. It's not even proof against MITM attacks, which are the only thing it's supposed to prevent!
acobster 10y ago
My bank limits passwords to ten chars. Ten! Have you ever heard any reasoning behind why they do this? The "best" excuse I've heard is so that customers don't forget. As if they don't have a "Forgot password?" link right there.
- tssva 10y ago
  Because somewhere they have a decades old legacy system that can't handle more than 10 characters.
- kasparsklavins 10y ago
  When I forget my banks password, I have to go to the closest client centre. Ironically, the only time I've had to do that is when my password was truncated.
kodt 10y ago
Comcast has the same issue. I changed the password for a user on my account using a password manager, it accepted a 20 character password with no errors, but then I was unable to login with that account. Changing to a 12 character password finally worked.
ntpeters 10y ago
A previous place I worked did almost the same thing. There was an internal website they had built that everyone used for time entry. It authenticated via LDAP, so you didn't need a separate login for it. However, the password box on the page only permitted passwords of up to 10 characters, but it wouldn't notify you it would just truncate whatever you typed in. So if you had a Windows password longer than 10 characters, you couldn't enter your time.

pluma 10y ago

Fun fact PayPal (used to?) silently cut off passwords when signing up, but not when logging in. And the password rules are of course not shown on the login screen. So good luck remember what length they cut your password down to when your password manager has stored the longer version.

tssva 10y ago

Here is a fun one. My credit union limits passwords to 32 characters and since I use lastpass for my passwords I had it generate a 32 character password when registering at the website. Next day I get around to downloading and setting up their mobile app. Login and get a prompt that since it is my first time using the mobile app. They have sent me an email with a 4 digit code I need to enter before proceeding in the app. The email with the code arrives quickly and I enter the code. Proceed to get an error message "Error 400: This service is not available at this time." Ok, they must be down I'll try again later. The code is good for 24 hours. Next morning find time to try again and get the same error message except this time it also informs me that my account has been locked. Call up customer service and with scarily little information get them to unlock my account. Explain what is happening with the app and the CS rep puts me on hold. Comes back and tells me the IT folks thought it must be a problem because of my email address. "Do you have a normal email address like from Gmail, Yahoo or hotmail?" I release a great sigh and give in to the stupidity I'm about to have to navigate. I provide a gmail address. They change the email associated with my account on their end and tell me I should try again in 24 hours. I do with the same results. Call back again and the CS person puts me on hold again while she reaches out to IT. This time whoever she talks to knows the issue right away. Turns out that when you login to the mobile app for the first time and submit the code it is actually appended to the end of your password and submits it as your password. Which if you have a password with more than 28 characters means you are exceeding the 32 character password max which causes them to return the informative, "Error 400: This service it not available at this time.", message.

NoGravitas 10y ago

When I was doing my taxes 2 years ago, I got bitten by the H&R Block website doing that. It did not inspire the trust.

Bartweiss 10y ago

And this from the same industry that pretends showing me a picture of a squirrel as a "secret image" meaningfully enhances my security. It's not even proof against MITM attacks, which are the only thing it's supposed to prevent!

acobster 10y ago

My bank limits passwords to ten chars. Ten! Have you ever heard any reasoning behind why they do this? The "best" excuse I've heard is so that customers don't forget. As if they don't have a "Forgot password?" link right there.

tssva 10y ago
Because somewhere they have a decades old legacy system that can't handle more than 10 characters.
kasparsklavins 10y ago
When I forget my banks password, I have to go to the closest client centre. Ironically, the only time I've had to do that is when my password was truncated.

kodt 10y ago

Comcast has the same issue. I changed the password for a user on my account using a password manager, it accepted a 20 character password with no errors, but then I was unable to login with that account. Changing to a 12 character password finally worked.

ntpeters 10y ago

A previous place I worked did almost the same thing. There was an internal website they had built that everyone used for time entry. It authenticated via LDAP, so you didn't need a separate login for it. However, the password box on the page only permitted passwords of up to 10 characters, but it wouldn't notify you it would just truncate whatever you typed in. So if you had a Windows password longer than 10 characters, you couldn't enter your time.