8 ms·
My banks online password requirements match the suggestions in these documents, but the passwords are entirely case insensitive. So its the same if I type "pass
by retox 10y ago
My banks online password requirements match the suggestions in these documents, but the passwords are entirely case insensitive. So its the same if I type "password" or "PaSSwOrD". There is a second passphrase that youre asked to select randomly chosen characters from combo boxes for, but that is case insensitive also. I got into an argument with their customer rep on Twitter about this not being the best case and they replied that it was based on industry best practice. I've never heard that before...
- will_hughes 10y agoCustomer Reps of any kind almost certainly have no idea about security. At best they'll ask their manager/helpdesk, who'll say "Just reply that it's based on industry standards" or something like that.
- Freak_NL 10y agoCustomer service at banks tend to reply "for safety reasons" to any question you pose about their antiquated password limitations. A password limit of 20 characters? That's for safety reasons. Which safety reasons? We can't tell you, because of safety reasons.
- mfukar 10y agoJust so I know what bank(s) to avoid, which one is (or are) this?
- Freak_NL 10y agoING in the Netherlands. Although to be fair, most banks have outrageously backwards password rules, and most limit the maximum length to something like 20 characters.
- will_hughes 10y agotl;dr: All of them. Try it, ask your bank why they impose a limit of N characters for their passwords (I bet N is < 30 characters). You'll almost certainly get a response along the lines of "We follow industry best practice" or something.
- AckSyn 10y ago> We can't tell you, because of safety reasons Reminds me of another "security" organization.
- throwaway76543 10y ago"Best" is perhaps not the right word but it's certainly a common practice. Several years back I asked my coworkers to test their banks and report back -- about two thirds of all banks and brokerages appear to flatten case in passwords.
- mataug 10y agoWhen passwords are case insensitive I'm always skeptical that they are storing passwords in plain text. Ofcourse they could be using a function to change the case before putting it through a oneway function but it just adds to the suspicion. The other horrid offence that I see banks make is preventing users from pasting / autofilling their passwords. This just asks for people to use common easy to guess passwords instead of a password manager.
- ntumlin 10y agoDisallowing autofill I could understand to prevent people from accidentally saving credentials on public devices. Maybe disallowing pasting is a (bad) attempt to disallow automated password guessing.
- Cthulhu_ 10y agoBetter safe than sorry right? I mean I can imagine pasting stuff into forms via some JS is how script kiddies start out.
- Already__Taken 10y agoIf you don't let keepass paste into your form I'm just not going to use you.
- hvidgaard 10y agoA password should be hashed client side, and lowercasing (or upper casing) before hashing would be trivial and just as secure if you accept that the searchspace is reduced.
- throwawaysbdi 10y agoEh, if you're using TLS it really doesn't matter where you hash. There's a lot of arguments for not doing secure hashing and encryption in JavaScript
- Chinjut 10y agoBest case, worst case, it's all case-insensitive…
- pepve 10y agoThe logic here is that it doesn't reduce security by much, but it significantly reduces password resets. Facebook does it too (and more) which we talked about two months ago: https://news.ycombinator.com/item?id=13426544 https://news.ycombinator.com/item?id=13426544 . Some good points were brought up.
- foota 10y agoFrom that thread, facebook passwords are actually still case sensitive, but attempt to match the hash with the password case inverted.
- alanfalcon 10y agoFixing the cAPS lOCK problem seems far less egregious than throwing out all case information.
- leppr 10y agoI experienced something similar with a government-certified "secure locker" web app my company is using to transfer paychecks and other documents to employees. After a few complaints to HR about changing provider (who must've forwarded the complaints to the "web locker" firm), they switched to case-sensitive match. Except now all the existing user's password had to be input in lowercase, since they were converting passwords to lowercase before storing them in plaintext!