4 ms·

I can confirm this. Wells Fargo, a very popular bank in the US, limits passwords to 6 to 14 characters. In fact, your passwords are not even case sensitive. Thi

I can confirm this. Wells Fargo, a very popular bank in the US, limits passwords to 6 to 14 characters. In fact, your passwords are not even case sensitive. This is absolutely unacceptable in 2018. I no longer have any bank accounts with Wells Fargo. In fact I don't have any bank accounts with any of these banks that have these stupid password restrictions.

MichaelGG 9y ago
Comments like these come up on bank security all the time. Now the bank isn't completely retarded. They have to deal with customer support (at a minimum) when hacked. How many people are being hacked due to 14 char limit? Probably zero, relative to malware and phishing. You're only allowed a few guesses before the account locks. So I fail to see how case sensitivity is relevant. Not defending these limits but to imply they have a very strong predictive power on bank security is probably wrong.
- ttsda 9y ago
  You're assuming their database doesn't leak and that account lock becomes irrelevant. Some banks are probably even storing passwords in plain-text or very old hashing methods that are not very effective in 2018.
mackey 9y ago
I almost didn't believe you because their own password page says to use mix case, but I just tried it... and flipping case totally works. Crazy!
- exikyut 9y ago
  Wow, that's quite a dark pattern.
soneil 9y ago
re: case insensitive .. I've heard of a bank with a similar problem, I don't recall which, where the reason was legacy compatibility with touch-tone phones. The password was normalized to something you could key in on a phone. This isn't an excuse, just a poorly-remembered anecdote as to how backwards some of these systems are.
- askvictor 9y ago
  I can actually see a case for case-insensitive password provided that other security measures are in place, and that there is an entropy requirement somewhere. I doubt that is the actual reason why those banks have it implemented, but it could certainly be argued that people will remember their passwords better if case is not an issue; and lets face it, most remember-able passwords will either be all of one case, or have the first letter capitalised. Goes back to the saying "Security at the expense of usability comes at the expense of security". This argument is based on the assumption of passwords needing to be remembered, which is certainly debatable from a security POV, but it a very common use pattern by humans.

MichaelGG 9y ago

Comments like these come up on bank security all the time. Now the bank isn't completely retarded. They have to deal with customer support (at a minimum) when hacked. How many people are being hacked due to 14 char limit? Probably zero, relative to malware and phishing. You're only allowed a few guesses before the account locks. So I fail to see how case sensitivity is relevant. Not defending these limits but to imply they have a very strong predictive power on bank security is probably wrong.

ttsda 9y ago
You're assuming their database doesn't leak and that account lock becomes irrelevant. Some banks are probably even storing passwords in plain-text or very old hashing methods that are not very effective in 2018.

mackey 9y ago

I almost didn't believe you because their own password page says to use mix case, but I just tried it... and flipping case totally works. Crazy!

exikyut 9y ago
Wow, that's quite a dark pattern.

soneil 9y ago

re: case insensitive .. I've heard of a bank with a similar problem, I don't recall which, where the reason was legacy compatibility with touch-tone phones. The password was normalized to something you could key in on a phone. This isn't an excuse, just a poorly-remembered anecdote as to how backwards some of these systems are.

askvictor 9y ago
I can actually see a case for case-insensitive password provided that other security measures are in place, and that there is an entropy requirement somewhere. I doubt that is the actual reason why those banks have it implemented, but it could certainly be argued that people will remember their passwords better if case is not an issue; and lets face it, most remember-able passwords will either be all of one case, or have the first letter capitalised. Goes back to the saying "Security at the expense of usability comes at the expense of security". This argument is based on the assumption of passwords needing to be remembered, which is certainly debatable from a security POV, but it a very common use pattern by humans.