5 ms·

Remember Chase is the bank where your passwords couldn't contain special characters and were limited to 12 characters up until 2017-2018 (I lost track, don't qu

Remember Chase is the bank where your passwords couldn't contain special characters and were limited to 12 characters up until 2017-2018 (I lost track, don't quote me). I wouldn't hold my money there if they paid me.

rickyc091 6y ago
Passwords weren't limited to 12 chars, but you are correct that they didn't allow special chars for a while.
- exabrial 6y ago
  Like I said I can't remember :) There was a max length I kept running into though. I believe also the passwords were case-insensitive.
kevindong 6y ago
At one point, my main bank (Charles Schwab) limited passwords to 6-8 characters (inclusive). You could type more if you wanted, but it would get truncated down to 8 characters. https://arstechnica.com/information-technology/2013/04/why-your-password-cant-have-symbols-or-be-longer-than-16-characters/#:~:text=The%20brokerage%20and%20banking%20company,sit%20well%20with%20some%20customers https://arstechnica.com/information-technology/2013/04/why-y....
milksteak42 6y ago
That's nothing. One of the largest banks in North America (BMO), limited passwords to 6 characters. Worse, for compatibility with telephone banking the characters were mapped to digits. That means there were only 1,000,000 possible unique passwords! They have 12,000,000 customers! They only just changed to complex passwords this year.
- parthdesai 6y ago
  TD would ignore casing in your password till 2 years ago
  - astura 6y ago
    Amex still does (just confirmed)
0xffff2 6y ago
Where would you hold it? Nearly every national bank seems to have some kind of issue like this.
astura 6y ago
This is par for the course for financial institutions. A credit union I previously had an account with required your passwords to be exactly six characters long. Then they added "two factor authentication" via SMS or phone call. Except now if you forgot your password then you just have to go to "forgot password" and get an SMS code sent to your phone to reset your password... So it was actually single factor authentication, you didn't need the password at all, just the phone.
acwan93 6y ago
American Express's passwords are (still! after 10 years!) case-insensitive. An attack on the US Banking system is a matter of when, not if.
- sjtgraham 6y ago
  So are RBS (including NatWest) in the UK.
mint2 6y ago
Except for legacy customers from acquired banks, they could include them. But if you changed your password it would not be allowed to use ones.

rickyc091 6y ago

Passwords weren't limited to 12 chars, but you are correct that they didn't allow special chars for a while.

exabrial 6y ago
Like I said I can't remember :) There was a max length I kept running into though. I believe also the passwords were case-insensitive.

kevindong 6y ago

At one point, my main bank (Charles Schwab) limited passwords to 6-8 characters (inclusive). You could type more if you wanted, but it would get truncated down to 8 characters. https://arstechnica.com/information-technology/2013/04/why-your-password-cant-have-symbols-or-be-longer-than-16-characters/#:~:text=The%20brokerage%20and%20banking%20company,sit%20well%20with%20some%20customers https://arstechnica.com/information-technology/2013/04/why-y....

milksteak42 6y ago

That's nothing. One of the largest banks in North America (BMO), limited passwords to 6 characters. Worse, for compatibility with telephone banking the characters were mapped to digits. That means there were only 1,000,000 possible unique passwords! They have 12,000,000 customers! They only just changed to complex passwords this year.

parthdesai 6y ago
TD would ignore casing in your password till 2 years ago
- astura 6y ago
  Amex still does (just confirmed)

0xffff2 6y ago

Where would you hold it? Nearly every national bank seems to have some kind of issue like this.

astura 6y ago

This is par for the course for financial institutions. A credit union I previously had an account with required your passwords to be exactly six characters long. Then they added "two factor authentication" via SMS or phone call. Except now if you forgot your password then you just have to go to "forgot password" and get an SMS code sent to your phone to reset your password... So it was actually single factor authentication, you didn't need the password at all, just the phone.

acwan93 6y ago

American Express's passwords are (still! after 10 years!) case-insensitive. An attack on the US Banking system is a matter of when, not if.

sjtgraham 6y ago
So are RBS (including NatWest) in the UK.

mint2 6y ago

Except for legacy customers from acquired banks, they could include them. But if you changed your password it would not be allowed to use ones.