3 ms·

E-trade: Your password can’t be >32 chars. Their 2FA TOTP gets concatenated to the end of your password. Got a >26 char password? You’ll be locked out after en

E-trade: Your password can’t be >32 chars. Their 2FA TOTP gets concatenated to the end of your password. Got a >26 char password? You’ll be locked out after enabling 2FA. No worries, though, you just call support, provide your email, and they disable 2FA for you..

amanj41 5y ago
holy shit that's bad
account42 5y ago
Wait so are they splitting the password and 2FA code again server-side or are they storing the password unhashed so that they can do the same concatenation there?