4 ms·
Air France requires account password to be between 4 and 6 characters
- blacksmith_tb 9y agoFor a long time Schwab.com also had an absurd policy like this - but the username on the account could be 3X longer, and contain special chars...
- bhhaskin 9y agobetween 4 and 6 is characters is pretty bad, but only numbers as well? Thats begging to be brute force.
- jleahy 9y agoWell even 4 numbers of 10,000 combinations. Say they lock the account out after 100 wrong attempts (hopefully), then assuming you don't choose 1234 or 0000 then you're pretty safe from a brute force attack. I'm guessing they require this so you can type it in over the phone, that's the only sensible reason I can think of.
- patrec 9y agoThis is not safe at all. If you do this with a hundred accounts, you're likely to hack at least one.
- corpMaverick 9y agoIt is safe for the individual accounts. Like a zebra in a zeal.
- tetha 9y agoLock what precisely? If you lock the specific account from all login attempts, you have a DoS opportunity on your hands. If you lock the specific account from specific IPs, botnets win. And I doubt a company would have requirements like this, and cross-ip and cross-account attack validations in place.
- ajarmst 9y agoJust going to go ahead and assume that Air France is using this to harvest bank account pins and luggage combinations in a creative bid to ensure they meet revenue projections this year.
- rollingpebbles 9y ago12345 https://youtu.be/a6iW-8xPw3k https://youtu.be/a6iW-8xPw3k
- twistedpair 9y agoMany companies that have heavy phone support call in usage do this, so you can easily enter the password over the phone keypad.
- uslic001 9y agoVerizon is the same way. 5 characters.