5 ms·

This doesn't surprise me. My BMO credit card has a 6 character password limit. Not minimum, limit!

xexers 8y ago
Wow! That seemed so unbelievable I had to google it: "Tangerine, much like BMO, also has a six character limit – numbers only, no letters and no special symbols allowed." https://www.theglobeandmail.com/technology/digital-culture/why-canadas-banks-have-weaker-passwords-than-twitter-or-google/article18325257/ https://www.theglobeandmail.com/technology/digital-culture/w...
- ymlaree 8y ago
  This smells plain text password storage..
  - gruez 8y ago
    at 6 characters, does it even matter? even salted + hashed + memory hard kdf isn't going to save you.
    - kevin_nisbet 8y ago
      Agreed, napkin math say's around 3 day's on a single CPU core to test every password.
  - clord 8y ago
    A little bird told me it's because they still use cobol fixed width data and are basically scared to change it. To fix, first they have to finish their rewrite.
    - giancarlostoro 8y ago
      Ouch... It saddens me when rewrites are not taken as seriously as they should be... Instead they rather risk people's personal information and finances.
    - skissane 8y ago
      Sometimes people resist fixing serious issues with a legacy system, because rewriting the legacy system is seen as preferable to evolving it. But, the rewrite always takes a lot longer than you expect, which can result in a lengthy period in which those issues continue to bite you. Just hire a few good mainframe COBOL programmers (they still exist) and fix the serious issues in the legacy system. Changing a legacy mainframe COBOL system shouldn't be scary. Provided you have qualified staff and the right tools (such as COBOL static analysis tools), it is not inherently more risky than changing a Java or .Net app.
    - jeromegv 8y ago
      What I don’t get is that tangerine was originally ING Direct. Which was a new bank that just started in Canada toward the end of 90s or early 2000s. How did they end up with a COBOL system?
      - Scoundreller 8y ago
        ING Direct's parent, the dutch ING, fell on hard times during the 2009 recession. So ING sold it off to The Bank of Nova Scotia (BNS). Canada's bank-friendly anti-consumer policy meant that ING Direct had some value, and BNS coughed up the most cash. They were only allowed to use the orange ING branding for a few years, so they changed it to something that was borderline familiar: an orange fruit. BNS probably had to, or chose to, switch ING clients over from the Dutch back-end to their Canadian one.
        jeromegv 8y ago
        6 character limit was already there during ING Direct years. Possible they were using the old Dutch systems but i find it a tad surprising, they would have needed to set it up from scratch in Canada (as I don’t think anything was stored in Netherlands). So they purposely setup an old-ass system in the 90s. What a shit show
        graeme 8y ago
        Plausible, but they had six digit codes from the beginning.
  - starky 8y ago
    It is because these companies are too lazy to change their systems to separate telephone banking and their online banking.
- kevin_nisbet 8y ago
  It's even better than that, to login to the tangerine website, you first enter you're username, and it returns back a picture and phrase you pre-select, before entering you're pin. When showing you the picture and phrase: >Important: If you don't recognize or see your picture and phrase, don't enter your PIN. First check that you entered the correct information. If you're still unsure, call 1-888-SAFE(7233)-304. Anyone care to guess my username, and steal my picture and phrase?
  - YZF 8y ago
    It's meant to be a very crude protection against entering your PIN on a site pretending to be Tangerine. Yeah, it's pretty dumb.
    - dade_ 8y ago
      As I recall from opening my account in the 90's the photo feature was always there. It was "forward thinking" at the time, but I can't say they have kept up that pace.
gruez 8y ago
>Not minimum, limit! 1 character passwords allowed?
- 52-6F-62 8y ago
  [Source: I have a Tangerine account] The password size is fixed at 6 integers. No more, no less.
  - brownell 8y ago
    So 1 million possible passwords? That's straight-up terrible entropy these days.
  - developer2 8y ago
    It's actually worse than that. It's fixed 4-digit or 6-digit. Most customers probably use the same 4-digit password for online/telephone banking as they use for their debit card's PIN. I don't care what legacy software the backend is built with; a 4-digit or 6-digit numerical password should frankly be an illegal way for a bank to do business.
pietroglyph 8y ago
Was there ever a reason why a limit like this was a good idea?
- gruez 8y ago
  legacy systems
  - pietroglyph 8y ago
    I understand that, but I'm looking for something more specific... Hashes aren't length-limited by design; I suppose storage size or database limitations could be an issue, but a 6-character password in ASCII with 1 million users is 6 megabytes.
    - deleted 8y ago
      [deleted]
    - mitchty 8y ago
      Hashes aren't limited, but the os might be limited in its implementation. ref: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/ikj2l2_LOGON_command_operands.htm https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/... And I quote: If you are RACF-defined, you must enter the password defined in the RACF® data set as the value for password. The new password specifies the password that is to replace the current password. new_password must be separated from password by a slash(/) and, optionally, one or more standard delimiters (tab, blank, or comma). new_password is 1 to 8 alphanumeric characters long. This operand is ignored for non-RACF defined users. (Printing is suppressed for some types of terminals when you respond to a prompt for a password.) With z/OS® V1R7 or later, the password and new_password can be in mixed case, if your installation has enabled RACF mixed case password support.
    - shakna 8y ago
      Some of these systems originate from the era when a 5mb hard drive was an incredible amount of space, even at enterprise level. They pre-date personal computing.
ams6110 8y ago
Most likely a limit on the underlying Mainframe software that was written in the 1980s.
- mitchty 8y ago
  Dollar to a donut there is a machine with IBM on it backing this up. At a prior life the ultimate reason why "you can type as many characters as you want but only the first 8 matter" came down to passing the login auth to a mainframe which only took 8 characters. Yes in EBCDIC, glad I never had to actually interface with them much, except for having to deploy ftps (ftp with ssl encryption, its an abomination, all due to no sftp on the mainframe at the time).
sangaya 8y ago
It's also case insensitive !!
nneonneo 8y ago
On the plus side, I guess this means you aren't using that password on any other sites? :P
RaceWon 8y ago
With "account security" questions too?

Wow! That seemed so unbelievable I had to google it: "Tangerine, much like BMO, also has a six character limit – numbers only, no letters and no special symbols allowed." https://www.theglobeandmail.com/technology/digital-culture/why-canadas-banks-have-weaker-passwords-than-twitter-or-google/article18325257/ https://www.theglobeandmail.com/technology/digital-culture/w...

ymlaree 8y ago
This smells plain text password storage..
- gruez 8y ago
  at 6 characters, does it even matter? even salted + hashed + memory hard kdf isn't going to save you.
  - kevin_nisbet 8y ago
    Agreed, napkin math say's around 3 day's on a single CPU core to test every password.
- clord 8y ago
  A little bird told me it's because they still use cobol fixed width data and are basically scared to change it. To fix, first they have to finish their rewrite.
  - giancarlostoro 8y ago
    Ouch... It saddens me when rewrites are not taken as seriously as they should be... Instead they rather risk people's personal information and finances.
  - skissane 8y ago
    Sometimes people resist fixing serious issues with a legacy system, because rewriting the legacy system is seen as preferable to evolving it. But, the rewrite always takes a lot longer than you expect, which can result in a lengthy period in which those issues continue to bite you. Just hire a few good mainframe COBOL programmers (they still exist) and fix the serious issues in the legacy system. Changing a legacy mainframe COBOL system shouldn't be scary. Provided you have qualified staff and the right tools (such as COBOL static analysis tools), it is not inherently more risky than changing a Java or .Net app.
  - jeromegv 8y ago
    What I don’t get is that tangerine was originally ING Direct. Which was a new bank that just started in Canada toward the end of 90s or early 2000s. How did they end up with a COBOL system?
    - Scoundreller 8y ago
      ING Direct's parent, the dutch ING, fell on hard times during the 2009 recession. So ING sold it off to The Bank of Nova Scotia (BNS). Canada's bank-friendly anti-consumer policy meant that ING Direct had some value, and BNS coughed up the most cash. They were only allowed to use the orange ING branding for a few years, so they changed it to something that was borderline familiar: an orange fruit. BNS probably had to, or chose to, switch ING clients over from the Dutch back-end to their Canadian one.
      - jeromegv 8y ago
        6 character limit was already there during ING Direct years. Possible they were using the old Dutch systems but i find it a tad surprising, they would have needed to set it up from scratch in Canada (as I don’t think anything was stored in Netherlands). So they purposely setup an old-ass system in the 90s. What a shit show
      - graeme 8y ago
        Plausible, but they had six digit codes from the beginning.
- starky 8y ago
  It is because these companies are too lazy to change their systems to separate telephone banking and their online banking.
kevin_nisbet 8y ago
It's even better than that, to login to the tangerine website, you first enter you're username, and it returns back a picture and phrase you pre-select, before entering you're pin. When showing you the picture and phrase: >Important: If you don't recognize or see your picture and phrase, don't enter your PIN. First check that you entered the correct information. If you're still unsure, call 1-888-SAFE(7233)-304. Anyone care to guess my username, and steal my picture and phrase?
- YZF 8y ago
  It's meant to be a very crude protection against entering your PIN on a site pretending to be Tangerine. Yeah, it's pretty dumb.
  - dade_ 8y ago
    As I recall from opening my account in the 90's the photo feature was always there. It was "forward thinking" at the time, but I can't say they have kept up that pace.

gruez 8y ago

>Not minimum, limit! 1 character passwords allowed?

52-6F-62 8y ago
[Source: I have a Tangerine account] The password size is fixed at 6 integers. No more, no less.
- brownell 8y ago
  So 1 million possible passwords? That's straight-up terrible entropy these days.
- developer2 8y ago
  It's actually worse than that. It's fixed 4-digit or 6-digit. Most customers probably use the same 4-digit password for online/telephone banking as they use for their debit card's PIN. I don't care what legacy software the backend is built with; a 4-digit or 6-digit numerical password should frankly be an illegal way for a bank to do business.

pietroglyph 8y ago

Was there ever a reason why a limit like this was a good idea?

gruez 8y ago
legacy systems
- pietroglyph 8y ago
  I understand that, but I'm looking for something more specific... Hashes aren't length-limited by design; I suppose storage size or database limitations could be an issue, but a 6-character password in ASCII with 1 million users is 6 megabytes.
  - deleted 8y ago
    [deleted]
  - mitchty 8y ago
    Hashes aren't limited, but the os might be limited in its implementation. ref: https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/ikj2l2_LOGON_command_operands.htm https://www.ibm.com/support/knowledgecenter/en/SSLTBW_2.1.0/... And I quote: If you are RACF-defined, you must enter the password defined in the RACF® data set as the value for password. The new password specifies the password that is to replace the current password. new_password must be separated from password by a slash(/) and, optionally, one or more standard delimiters (tab, blank, or comma). new_password is 1 to 8 alphanumeric characters long. This operand is ignored for non-RACF defined users. (Printing is suppressed for some types of terminals when you respond to a prompt for a password.) With z/OS® V1R7 or later, the password and new_password can be in mixed case, if your installation has enabled RACF mixed case password support.
  - shakna 8y ago
    Some of these systems originate from the era when a 5mb hard drive was an incredible amount of space, even at enterprise level. They pre-date personal computing.

ams6110 8y ago

Most likely a limit on the underlying Mainframe software that was written in the 1980s.

mitchty 8y ago
Dollar to a donut there is a machine with IBM on it backing this up. At a prior life the ultimate reason why "you can type as many characters as you want but only the first 8 matter" came down to passing the login auth to a mainframe which only took 8 characters. Yes in EBCDIC, glad I never had to actually interface with them much, except for having to deploy ftps (ftp with ssl encryption, its an abomination, all due to no sftp on the mainframe at the time).

sangaya 8y ago

It's also case insensitive !!

nneonneo 8y ago

On the plus side, I guess this means you aren't using that password on any other sites? :P

RaceWon 8y ago

With "account security" questions too?