4 ms·

So again if they take it so seriously why enforce such an arbitrary limit on password length?

• tracker1 9y ago
  Probably weird arbitrary rules around legacy systems... I don't know about PayPal specifically, they're really too young that it shouldn't be an issue. I know other banks with account federation have had some systems running that are severely limited. It's weird all the way around tbh. I do hope the new NIST recommendations get more weight moving forward, but banking tends to rely on other authentication/validation routes beyond just the password to strengthen things. Which is probably okay.. unless your device is found, and not password protected itself, with a relatively secure password. Even then...
  • sli 9y ago
    2FA would be great, so long as SMS isn't the only option every time. I've moved to a much more tech savvy bank these days, but there was a long while were my bank's website was, by a hilariously wide margin, the least secure website that I regularly visited. It was in fact one of my reasons for switching banks (the other reasons are not relevant here).