4 ms·

Who in the right mind thought that would be a good idea? It seems like the type of case where some executive though that failed password attempts would increase

by xmprt 6y ago

Who in the right mind thought that would be a good idea? It seems like the type of case where some executive though that failed password attempts would increase customer support load by 0.1% and therefore decided to make it a lot easier to log in. But in that case, why did they decide to stop at 8? I feel like they would have made passwords a 4 digit pin if they had their way.

bluGill 6y ago
Probably someone working on a limited mainframeish type computer in 1964 when many terminals didn't support lower case and the memory to store passwords was expensive. The idea of encrypting the password probably didn't exist in those days either. None of this mattered because all the terminals were inside their building so you had to get by the guard to get in. Best practices have moved on many times since then.
- OGWhales 6y ago
  This was my guess too. Last mainframe I used still used 8 character, non case-sensitive passwords.
deleted 6y ago
[deleted]
sjy 6y ago
> they would have made passwords a 4 digit pin if they had their way There’s a well-known bank in Australia that has been doing this for years [1]. It’s very convenient, and if there was a significant fraud risk associated with it, you’d think they would have changed their policy by now. [1] https://www.ing.com.au/securebanking/ https://www.ing.com.au/securebanking/
- xmprt 6y ago
  You need a client number for that which is an additional level of security since most people keep that a secret as well.
harha 6y ago
> Who in the right mind thought that would be a good idea? Someone who doesn’t care or know or care to know. If the company (or manager in some cases) doesn’t treat people right they may not do anything above the bare minimum to survive. So the next time a problem comes up, e.g. the old password field in the database only holds 8 characters but someone sent a memo around requiring users to provide passwords of a certain length, they might just truncate the input - problem solved, now back to lunch. Or if they would have to argue or fill in a form for a new database, they might just not do it. It could even be that they have incentive for this, e.g., easier to get raise if they don’t ask for new task related things all the time. Whenever something stupid happens I’m reminded of the movie Office Space, this happens even at FAANGs.

by xmprt 6y ago

bluGill 6y ago

Probably someone working on a limited mainframeish type computer in 1964 when many terminals didn't support lower case and the memory to store passwords was expensive. The idea of encrypting the password probably didn't exist in those days either. None of this mattered because all the terminals were inside their building so you had to get by the guard to get in. Best practices have moved on many times since then.

OGWhales 6y ago
This was my guess too. Last mainframe I used still used 8 character, non case-sensitive passwords.

deleted 6y ago

[deleted]

sjy 6y ago

> they would have made passwords a 4 digit pin if they had their way There’s a well-known bank in Australia that has been doing this for years [1]. It’s very convenient, and if there was a significant fraud risk associated with it, you’d think they would have changed their policy by now. [1] https://www.ing.com.au/securebanking/ https://www.ing.com.au/securebanking/

xmprt 6y ago
You need a client number for that which is an additional level of security since most people keep that a secret as well.

harha 6y ago

> Who in the right mind thought that would be a good idea? Someone who doesn’t care or know or care to know. If the company (or manager in some cases) doesn’t treat people right they may not do anything above the bare minimum to survive. So the next time a problem comes up, e.g. the old password field in the database only holds 8 characters but someone sent a memo around requiring users to provide passwords of a certain length, they might just truncate the input - problem solved, now back to lunch. Or if they would have to argue or fill in a form for a new database, they might just not do it. It could even be that they have incentive for this, e.g., easier to get raise if they don’t ask for new task related things all the time. Whenever something stupid happens I’m reminded of the movie Office Space, this happens even at FAANGs.