3 ms·

A lot of the alternatives aren't much better. Fidelity for example would allow you to input your password as the numerical equivalent (think phone keypad - A,

A lot of the alternatives aren't much better. Fidelity for example would allow you to input your password as the numerical equivalent (think phone keypad - A, B or C map to "1" and so on). Which basically requires modifying your password before hashing it (and dramatically reducing entropy in the process). I'm not sure if they still do this. http://mattstockton.com/2013/03/20/my-bank-password-is-sort-of-hashed/ http://mattstockton.com/2013/03/20/my-bank-password-is-sort-... I think I recall Vanguard having had something similar but I can't find it in searching, so perhaps not.

karlding 6y ago
According to Fidelity's website [0] they still do so ("You'll be asked to enter your username and password using the keypad on your phone."). I basically assume any financial institution that provides support for the old "telephone banking" methods via DTMF tones either stores your password in plaintext or a hashed version that reduces entropy. I'm honestly surprised hackers haven't gotten sophisticated enough to bruteforce these reduced entropy login passwords using a Twilio account. [0] https://www.fidelity.com/customer-service/phone-numbers/overview https://www.fidelity.com/customer-service/phone-numbers/over...