2 ms·

password policy for my.equifax.com is ... not best practice. at least they allow up to 20 characters. must include one special character from a set of ... FIVE.

• criddell 8y ago
  Whenever they limit the number of characters to something small, it makes me wonder if they are storing the password in their database rather than some hash of the password. I complained about this to my old bank (Wells Fargo) and they told me not to worry about it because I'm protected from fraud.
  • mjevans 8y ago
    It generally means they're not handling it in a secure way. Worst case scenario is that if the checks you see client side aren't also server side someone might be able to inject things that run as... whatever the server side processes are. Usually anyplace that has a limit less than 512 characters (often 1024, but some string buffers are small) or on the characters you can use, at all, isn't doing it right.
    • jiveturkey 8y ago
      It generally means that yes. But sometimes it also has to do with CSR calls. eg, by not allowing spaces in passwords, you eliminate an entire class of PEBKAC errors. I don't for a second believe that's why my.equifax.com is doing it. It's certainly not why there's a 20 character limit. (I personally use 64 char passwords wherever such long ones are allowed.)