5 ms·

Discord has stronger authentication methods than any of the 8 or so financial institutions I have accounts with. All 8+ do their auth quite differently yet the

Discord has stronger authentication methods than any of the 8 or so financial institutions I have accounts with. All 8+ do their auth quite differently yet they're all broken and they all fall back on SSN. Why hasn't this industry standardized around one process that is actually effective? Recently I made an account with Fidelity brokerage. Username maxes at 12 chars or something, password at 20. Not the worst, but then I had to get phone support and to authenticate over the phone you need to enter either your username or SSN on the keypad, and then the password on the keypad. The charspace of both the username and password have thus been reduced to 0-9 and * for all specials. Another institution is for my employee share purchase plan. The phone support can initiate sells and transfers I'm pretty sure, yet their only auth is for my full name, employee number, and birthday. My employee number is literally printed on my laptop and some other stuff next to my full name, my birthday easily googleable with my name.

criddell 9y ago
Can somebody explain why there should be any limit on passwords? I understand there has to be some limit, but why not make it an arbitrarily large number? Like 1000 characters? I asked my bank about this and they forwarded my question to their security department and the reply was "don't worry - you aren't responsible for fraudulent transactions".
- lakechfoma 9y ago
  Since I've been getting support so much lately with a few institutions, I've been asking them questions like that as well. They all serve up that same answer. For me, and I'd guess a lot of other people, I don't care if the money can _eventually_ be returned, I'm concerned for the day that my life savings goes missing and I have to spend days or weeks stressed to shit about when or if I'll get it back, meanwhile not sure if I can pay rent.
  - theandrewbailey 9y ago
    ...or pay the bills. If you're late on your credit card/loan/mortgage payments, that shit gets on your credit report. Good luck clearing that up. I'm doubtful that "my bank has bad security, so someone stole all my money" will get you much sympathy.
- jccooper 9y ago
  There's no reasonable limit if the password is being properly hashed. Just whatever fits in a request, really. My fear and supposition is that someone's storing the password in cleartext in some ancient SQL database somewhere, or blindly working from design specs that assume that. There are some alternate, more charitable explanations, mostly to do with UI or UX, but none of those are particularly more encouraging.

criddell 9y ago

Can somebody explain why there should be any limit on passwords? I understand there has to be some limit, but why not make it an arbitrarily large number? Like 1000 characters? I asked my bank about this and they forwarded my question to their security department and the reply was "don't worry - you aren't responsible for fraudulent transactions".

lakechfoma 9y ago
Since I've been getting support so much lately with a few institutions, I've been asking them questions like that as well. They all serve up that same answer. For me, and I'd guess a lot of other people, I don't care if the money can _eventually_ be returned, I'm concerned for the day that my life savings goes missing and I have to spend days or weeks stressed to shit about when or if I'll get it back, meanwhile not sure if I can pay rent.
- theandrewbailey 9y ago
  ...or pay the bills. If you're late on your credit card/loan/mortgage payments, that shit gets on your credit report. Good luck clearing that up. I'm doubtful that "my bank has bad security, so someone stole all my money" will get you much sympathy.
jccooper 9y ago
There's no reasonable limit if the password is being properly hashed. Just whatever fits in a request, really. My fear and supposition is that someone's storing the password in cleartext in some ancient SQL database somewhere, or blindly working from design specs that assume that. There are some alternate, more charitable explanations, mostly to do with UI or UX, but none of those are particularly more encouraging.