4 ms·

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characte

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ https://banking.westpac.com.au/ I complained to them about this years ago, they replied explaining they knew what they were doing and it was a balance between security and simplicity...

reactor 7y ago
Mainframe it is then.
- znpy 7y ago
  could be (old) cobol, not necessarily on a mainframe
the_french 7y ago
Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.
- chris_overseas 7y ago
  Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say: "At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers. From the end of May 2018, we will be removing the keypad from the online sign-in screen and replacing it with an open text box, which allows you to type in your Customer ID and password. ... Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..." Passwords remained fixed at 6 characters however.
  - loeg 7y ago
    The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the '<input type="password">' element, and add 'value="[paste]"' manually.
    - manmademagic 7y ago
      I used to bank with WestPac and from memory it wasn’t possible to do this as they had some additional javascript running that would cipher every letter.
- moftz 7y ago
  I got firefox to remember passwords for a couple sites that were blocking autofill. It involved opening up the xml file where passwords are stored, copying the latest entry, changing the url and ID number, then opening up the password manager in firefox and updating the actual password there since the XML file only stores an encrypted version. It wouldn't autofill instantly, had to click on the username box to get it to work but it saved me a lot of time from entering a massive password that system required.
- reinkaos 7y ago
  This is common in Brazil as well. Allegedly they are trying to avoid keyloggers. Obviously people just improved keyloggers to take screenshots at precise times.
stazz1 7y ago
"We know what we're doing" and "There's no way we can upgrade the infrastructure" might be holding hands in that moment
dx87 7y ago
A company that my retirement plan used to be with was worse than that. The password could only be numbers and letters, and they would silently truncate your password to 8 characters. The worst part though, is the password was stored in a way that it could be entered on a touch tone phone. So case was silently ignored for letters, and the characters "2abcABC" were all stored as the number 2, and so on for the rest of the buttons on the phone. They also didn't support two-factor authentication. They've since updated the password requirement to something more sane, but it was baffling that they would ever do that.
- anbr 7y ago
  All major telecos in Spain do the same. One of the largest asks you to set up only a 6-digit PIN to access the customer portal and no 2FA. They send you your PIN by SMS as a confirmation. All your invoices (with the details of the numbers you called) as well as other personal details, are "protected" by a 6-digit PIN. I want to think they have other protection mechanisms in place, but I seriously doubt it.
- loeg 7y ago
  Oh, I see you've had a Fidelity account too.
efa 7y ago
Looks like they are using Fiserv (lots of Fiserv references in the code). Fiserv is a huge provider of banking services. If Fiserv is requiring these ridiculous id/pw requirements that would be even more scary.
- efa 7y ago
  https://krebsonsecurity.com/tag/fiserv/ https://krebsonsecurity.com/tag/fiserv/
SkyBelow 7y ago
Expect this to keep happening until we put the full and entire cost of identify theft onto the companies who are defrauded by the thief.
- loeg 7y ago
  It's not identity theft, it's just fraud. Calling it identity theft is an attempt to put the cost and responsibility for ordinary fraud on the victims.
manmademagic 7y ago
ING Australia is even worse for this, as it’s an 8 digit acc number with a 4 digit PIN to login. St. George isn’t as terrible, but they have a quirk of requiring a 4 digit security number along with your password. That’s not how MFA works... Better security practices and open APIs are the two things I wish banks would get sorted.
reinkaos 7y ago
TIL my Westpac password is case insensitive. Today wasn't a good day.

reactor 7y ago

Mainframe it is then.

znpy 7y ago
could be (old) cobol, not necessarily on a mainframe

the_french 7y ago

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

chris_overseas 7y ago
Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say: "At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers. From the end of May 2018, we will be removing the keypad from the online sign-in screen and replacing it with an open text box, which allows you to type in your Customer ID and password. ... Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..." Passwords remained fixed at 6 characters however.
- loeg 7y ago
  The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the '<input type="password">' element, and add 'value="[paste]"' manually.
  - manmademagic 7y ago
    I used to bank with WestPac and from memory it wasn’t possible to do this as they had some additional javascript running that would cipher every letter.
moftz 7y ago
I got firefox to remember passwords for a couple sites that were blocking autofill. It involved opening up the xml file where passwords are stored, copying the latest entry, changing the url and ID number, then opening up the password manager in firefox and updating the actual password there since the XML file only stores an encrypted version. It wouldn't autofill instantly, had to click on the username box to get it to work but it saved me a lot of time from entering a massive password that system required.
reinkaos 7y ago
This is common in Brazil as well. Allegedly they are trying to avoid keyloggers. Obviously people just improved keyloggers to take screenshots at precise times.

stazz1 7y ago

"We know what we're doing" and "There's no way we can upgrade the infrastructure" might be holding hands in that moment

dx87 7y ago

A company that my retirement plan used to be with was worse than that. The password could only be numbers and letters, and they would silently truncate your password to 8 characters. The worst part though, is the password was stored in a way that it could be entered on a touch tone phone. So case was silently ignored for letters, and the characters "2abcABC" were all stored as the number 2, and so on for the rest of the buttons on the phone. They also didn't support two-factor authentication. They've since updated the password requirement to something more sane, but it was baffling that they would ever do that.

anbr 7y ago
All major telecos in Spain do the same. One of the largest asks you to set up only a 6-digit PIN to access the customer portal and no 2FA. They send you your PIN by SMS as a confirmation. All your invoices (with the details of the numbers you called) as well as other personal details, are "protected" by a 6-digit PIN. I want to think they have other protection mechanisms in place, but I seriously doubt it.
loeg 7y ago
Oh, I see you've had a Fidelity account too.

efa 7y ago

Looks like they are using Fiserv (lots of Fiserv references in the code). Fiserv is a huge provider of banking services. If Fiserv is requiring these ridiculous id/pw requirements that would be even more scary.

efa 7y ago
https://krebsonsecurity.com/tag/fiserv/ https://krebsonsecurity.com/tag/fiserv/

SkyBelow 7y ago

Expect this to keep happening until we put the full and entire cost of identify theft onto the companies who are defrauded by the thief.

loeg 7y ago
It's not identity theft, it's just fraud. Calling it identity theft is an attempt to put the cost and responsibility for ordinary fraud on the victims.

manmademagic 7y ago

ING Australia is even worse for this, as it’s an 8 digit acc number with a 4 digit PIN to login. St. George isn’t as terrible, but they have a quirk of requiring a 4 digit security number along with your password. That’s not how MFA works... Better security practices and open APIs are the two things I wish banks would get sorted.

reinkaos 7y ago

TIL my Westpac password is case insensitive. Today wasn't a good day.