4 ms·

In reality a lot of people don't see any difference between "Password123", "password123" or "PASSWORD123". I was once talking to a bank and had to give char n o

by wlll 10y ago

In reality a lot of people don't see any difference between "Password123", "password123" or "PASSWORD123". I was once talking to a bank and had to give char n of my password and I said something like "Uppercase E" and the rep on the other end of the phone actually scoffed at me "Capitals don't make any difference in passwords" and clearly thought I was an idiot. I am in two minds wether a service used by non technical people should allow for case insensitive passwords, it'd be interesting to see what the difference in support load, customer satisfaction and churn would be for both case sensitive and case insensitive passwords, and also enforcing minimum complexity.

adanto6840 10y ago
That bank sounds to have bigger issues: perhaps obvious, it's very likely that they were storing the password as plaintext -- since they were able to ask you for a specific character and verify that your answer was correct. Scary. Have also never heard of a bank that actually asked for a password, substring or not, at least aside from being asked for a 'Phone PIN' or similar lesser/non-critical to authentication piece of information.
- brazzledazzle 10y ago
  It's possible that they create the character entry when you set your password and the bank/operator only has access to that particular character in plain text.
- 77pt77 10y ago
  In my experience banks store pins in plaintext way to often. The uppercase being indifferent is a first for me but I've had those people tell me that performing copy paste into the password input somehow changed the authentication procedure. He again acted as if I was a complete idiot for suggesting that that made no sense.
- joe463369 10y ago
  If your bank is compromised to the point that your password - plaintext or otherwise - has been discovered, can things get much worse?
- wlll 10y ago
  The point was more about the reaction of the rep, that it was ludicrous of me to consider passwords to be case sensitive, but yeah, not a good sign in general, though as I use a unique password for everything (1Password) I'm less concerned. Related, the "3d secure" credit card verification system asks for individual chars of a password (at least in the UK).

by wlll 10y ago

adanto6840 10y ago

That bank sounds to have bigger issues: perhaps obvious, it's very likely that they were storing the password as plaintext -- since they were able to ask you for a specific character and verify that your answer was correct. Scary. Have also never heard of a bank that actually asked for a password, substring or not, at least aside from being asked for a 'Phone PIN' or similar lesser/non-critical to authentication piece of information.

brazzledazzle 10y ago
It's possible that they create the character entry when you set your password and the bank/operator only has access to that particular character in plain text.
77pt77 10y ago
In my experience banks store pins in plaintext way to often. The uppercase being indifferent is a first for me but I've had those people tell me that performing copy paste into the password input somehow changed the authentication procedure. He again acted as if I was a complete idiot for suggesting that that made no sense.
joe463369 10y ago
If your bank is compromised to the point that your password - plaintext or otherwise - has been discovered, can things get much worse?
wlll 10y ago
The point was more about the reaction of the rep, that it was ludicrous of me to consider passwords to be case sensitive, but yeah, not a good sign in general, though as I use a unique password for everything (1Password) I'm less concerned. Related, the "3d secure" credit card verification system asks for individual chars of a password (at least in the UK).