3 ms·

Banking in Canada is rough too. TD Canada Trust didn't let me use more than 8 alphanumeric characters in my password until about 2015. The only let you use ca

Banking in Canada is rough too. TD Canada Trust didn't let me use more than 8 alphanumeric characters in my password until about 2015. The only let you use call or SMS for 2FA to this day. They are charging $16.95/mo for a chequing account right now. This is pretty standard across the big banks.

auxym 4y ago
I believe Scotia/Tangerine are still 6-digits only for passwords. Really. And I have yet to see any Canadian financial institution (whether bank, brokerage, credit union, etc) that supports anything else than SMS for 2FA. The situation is quite rough indeed.
- angst_ridden 4y ago
  RBC allows use of their mobile app as 2FA. I don't believe it uses SMS under the hood. I'm not arguing it's necessarily more secure. I haven't audited it or looked into how it works.
spaetzleesser 4y ago
Is there any reason why they limit the length of passwords or don’t allow certain characters? It makes no sense to me.
- freeone3000 4y ago
  It's so you can enter your password over a touch-tone phone.
- WorldMaker 4y ago
  As fun general rules of thumb: Hard 8 character limits are often a side-effect of old COBOL "databases" in the backend somewhere. Hard 16 character limits are sometimes a side-effect of old versions of Active Directory in the backend somewhere or new versions of Active Directory in certain backward compatibility operation modes/certain group policies. Hard character limits in general are often a sign that someone is storing the plaintext somewhere they shouldn't be. (Soft character limits today are mostly to avoid possible hash function DDoS.)
  - EvanAnderson 4y ago
    The 14 character password limit in some versions of Windows is a side effect of using LM and NTLM (original "flavor", not NTLMv2) hashes used in Windows NT domains and maintaining compatibility therewith. It's not related to Active Directory, per se. Nobody should be using LM or NTLM hashes anymore today, for all that that means... >sigh<
- wlonkly 4y ago
  Shared credentials with phone or ATM banking.
wlonkly 4y ago
TD has TOTP-based 2FA now, but you have to use their "TD Authenticator" app and not your preferred TOTP app.

auxym 4y ago

I believe Scotia/Tangerine are still 6-digits only for passwords. Really. And I have yet to see any Canadian financial institution (whether bank, brokerage, credit union, etc) that supports anything else than SMS for 2FA. The situation is quite rough indeed.

angst_ridden 4y ago
RBC allows use of their mobile app as 2FA. I don't believe it uses SMS under the hood. I'm not arguing it's necessarily more secure. I haven't audited it or looked into how it works.

spaetzleesser 4y ago

Is there any reason why they limit the length of passwords or don’t allow certain characters? It makes no sense to me.

freeone3000 4y ago
It's so you can enter your password over a touch-tone phone.
WorldMaker 4y ago
As fun general rules of thumb: Hard 8 character limits are often a side-effect of old COBOL "databases" in the backend somewhere. Hard 16 character limits are sometimes a side-effect of old versions of Active Directory in the backend somewhere or new versions of Active Directory in certain backward compatibility operation modes/certain group policies. Hard character limits in general are often a sign that someone is storing the plaintext somewhere they shouldn't be. (Soft character limits today are mostly to avoid possible hash function DDoS.)
- EvanAnderson 4y ago
  The 14 character password limit in some versions of Windows is a side effect of using LM and NTLM (original "flavor", not NTLMv2) hashes used in Windows NT domains and maintaining compatibility therewith. It's not related to Active Directory, per se. Nobody should be using LM or NTLM hashes anymore today, for all that that means... >sigh<
wlonkly 4y ago
Shared credentials with phone or ATM banking.

wlonkly 4y ago

TD has TOTP-based 2FA now, but you have to use their "TD Authenticator" app and not your preferred TOTP app.