3 ms·
From the GitHub issue about BMO: The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed
by WillDaSilva 7y ago
From the GitHub issue about BMO:
The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed).
The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also able to login with 727796 or rARsYo or anything else that mapped to the same characters.
I really should have switched banks when I found this out.
That's so strange (and awful). I wonder how they discovered that this mapping was being done.
- sundarurfriend 7y agoThe horizontal scrolling makes the quoted part pretty hard to read. If it's still editable, please consider changing that to simple `> ` based quoting. Edit: Link to the github issue comment mentioned - https://github.com/dumb-password-rules/dumb-password-rules/issues/133#issuecomment-528665304 https://github.com/dumb-password-rules/dumb-password-rules/i...
- saagarjha 7y agoMade a typo that happened to map to the same sequence on a telephone keypad?
- dilatorily 7y agoFrom what I remember, their online banking system was built on their legacy telephone banking system.
- mittonface 7y agoI made this comment. Since you're curious: I signed into telebanking and it asked for me to input my password. I didn't ever remember setting a phone password, so I tried punching in the numbers that corresponded to my online banking password. It worked. Obviously the only way this would work is if they stored the numeric keypad representation of your password instead of your actual password. So I experimented a bit and found password horror.