3 ms·

Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they ma

Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they may just convert to uppercase before hashing, but it is bad practice either way. There is a lot more possible entropy if QwErTy and QWERTY are distinct. However, there seems to be issues in the entire financial sector with inability to upgrade certain systems due to massive amounts of legacy code. That being said, my local credit union's system distinguishes case for passwords; and they were unable to give a family member their password (they had to issue a reset) which at least leads me to believe they are hashing passwords instead of storing in plaintext.

slumdev 7y ago
My gut reaction to your story would be to assume that your local credit union is doing a better job than the big banks, not that there's a good explanation for the big banks. Credit unions frequently also offer better mortgage APRs, better savings APYs, better customer service, lower (or no) ATM fees, etc.
- gtk40 7y ago
  My local credit union (one of the largest 25 NCUA insured in the U.S.) until about 5 years ago used your debit pin as the only password for online login and didn't allow changing the password or adding a second factor.
77pt77 7y ago
> This doesn't confirm that they store passwords in plaintext They definitely store pincodes.
- lawnchair_larry 7y ago
  That doesn’t matter. Hashing something with such low entropy does nothing.