4 ms·

My bank introduced "usernames" at some point, breaking login with email addresses, but didn't document this fact, or enforce that usernames not be set to email

My bank introduced "usernames" at some point, breaking login with email addresses, but didn't document this fact, or enforce that usernames not be set to email addresses. For a few months, every time I went to login, I had to use the "find my account" function, and each time I would again set my username to my email address (and why wouldn't I, it had been my login credential for nearly a decade by that point). At no point did it ever enforce a restriction on the @ or . in the username, until I went to login. It took me literal months to figure out and set it to something else. This is Capital One by the way. My account was originally ING Direct, then Capital One 360, before being fully incorporated into the rest of their nonsense, and I assume that's related to the username situation.

deleted 2y ago
[deleted]
deleted 2y ago
[deleted]
EduardoBautista 2y ago
At a Mexican bank, Banregio, there was a character limit to the username on mobile but not on web. So I originally had a username that was accepted at registration but not when I tried to log in on my phone and it wouldn’t allow me to input my entire username. Edit: The issue was with the password field, not the username.
- waterproof 2y ago
  USAA had a similar issue for some time, but with the password field. One interface (web or mobile, I don’t remember) would silently truncate the password. You couldn’t even tell it was being truncated because it was all **!
  - EduardoBautista 2y ago
    Actually, looking at the credentials in 1Password for this bank, my issue was with the password field, so similar to USAA. Mobile had a 15 character limit.
- cuu508 2y ago
  Speaking of character limits, my bank, Swedbank Latvia, used to have a 16-character limit on passwords. After lots and lots and lots of pestering over various channels, they finally fixed it. But the "fix" was to add a maxlength attribute on an input field. So the field will accept the 16 first characters and ignore the rest (password fields are masked so the user cannot see the field is not accepting their input). So yes, I could now set my password to "SwedbankSecurityExperts", yay. But I could later log in with "SwedbankSecurityIncompetence" as well...
  - vladvasiliu 2y ago
    Well, 16 isn't so bad. Here, in France, BNP accounts must have exactly six digit passwords. They're also incompatible with password managers: you have to click the number on a visual number pad.
    - deleted 2y ago
      [deleted]
    - Teever 2y ago
      Surely that must afoul of some sort of French laws regarding accessibility? How are blind people supposed to use this UI?
      - vladvasiliu 2y ago
        To be honest, I'm neither a web dev/designer nor do I have bad sight, so I admit I don't really know how accessibility works. I expect this to be compatible with screen readers somehow, they even say they take this seriously. But from a quick glance at the Accessibility tab in Firefox, I see many complaints about "interactive elements must be labeled". Obviously, if the computer reads aloud the password as you type it, it's an absolute win for security, and I'm sure some PMs somewhere are quite content with a job well done. For the curious, here's the login page: https://mabanque.bnpparibas/fr/connexion https://mabanque.bnpparibas/fr/connexion
        2y ago
- fragmede 2y ago
  I had that problem with a major US bank. Copy and pasting or retyping the password worked, because doing so hit the client side JavaScript that truncated the password. If the password manager filled it out, it wouldn't work because it bypassed that JavaScript.
- MSFT_Edging 2y ago
  At some point paypal had a character limit on the password, but wouldn't warn you when you set the password. So I set a long password, and was denied entry when using it, until i figured out the limit. Ex, i created the account with "mySuperAwesomeHunter2Password". But the limit was somewhere in the middle so I had to enter "MySuperAweso" to log in. They fixed it since then but I stopped using it except as a payment proxy. No money will ever be stored on paypal after that nonsense.
deleted 2y ago
[deleted]
dilawar 2y ago
This is nothing. My bank account (HDFC india) starts with 00. Dare send it to any accounting person who will copy paste it into an excel sheet and bang.. the prefix 00 is gone. Now they will complain that your account details are wrong. Took me a few months to figure out what was really going on.
- ctxc 2y ago
  Not to mention the disabled copy pasting.
- ryoshu 2y ago
  Had a similar thing happen when my small regional bank was rolled up through a couple M&A's and I have 00s and my regional account number remained. If I ever have to call them I have to explain the situation because when I start with 0s they don't believe me.
- toss1 2y ago
  Yup. Here in USA, Citizen's bank, iirc a subsidiary of Royal Bank Of Scotland, has had a bug for years that prevents me from changing my password. The only way to do it is via a series of tech support calls, despite the fact that they've had an open ticket for years. The source of the problem? Can't do it on an account where the email address (not the username) has a less-than-3-character-long name, as in "ab@mycomain.com". I own a small company and setup initials for easy-to-use email addresses, and found zero problems anywhere else in the world. But these clowns seem to need "abc@..." to function correctly. I've found bankers tend to not be the brightest bulbs in the box, and this is but one example.
hypercube33 2y ago
Up until a few years ago WF didn't process case in passwords. you could set your password to Hello and log in with hello
vonrosen2000 2y ago
I think Bank of America doesn't allow exclamation mark in password. It is strange. One of the largest banks on earth.
DarkUranium 2y ago
My own bank used to have [A-Za-z0-9] passwords with a character limit + browser certificates. I thought the former was pretty bad (and it's always alarming, as it tends to imply they're storing it in plaintext if they even care what the characters are ...). Then they got bought by another bank ... and now, they require *6-digit* PINs/passwords + no certificates. Yes, there's 2FA involved now, but seriously, 6 digits?

deleted 2y ago

[deleted]

deleted 2y ago

[deleted]

EduardoBautista 2y ago

At a Mexican bank, Banregio, there was a character limit to the username on mobile but not on web. So I originally had a username that was accepted at registration but not when I tried to log in on my phone and it wouldn’t allow me to input my entire username. Edit: The issue was with the password field, not the username.

waterproof 2y ago
USAA had a similar issue for some time, but with the password field. One interface (web or mobile, I don’t remember) would silently truncate the password. You couldn’t even tell it was being truncated because it was all **!
- EduardoBautista 2y ago
  Actually, looking at the credentials in 1Password for this bank, my issue was with the password field, so similar to USAA. Mobile had a 15 character limit.
cuu508 2y ago
Speaking of character limits, my bank, Swedbank Latvia, used to have a 16-character limit on passwords. After lots and lots and lots of pestering over various channels, they finally fixed it. But the "fix" was to add a maxlength attribute on an input field. So the field will accept the 16 first characters and ignore the rest (password fields are masked so the user cannot see the field is not accepting their input). So yes, I could now set my password to "SwedbankSecurityExperts", yay. But I could later log in with "SwedbankSecurityIncompetence" as well...
- vladvasiliu 2y ago
  Well, 16 isn't so bad. Here, in France, BNP accounts must have exactly six digit passwords. They're also incompatible with password managers: you have to click the number on a visual number pad.
  - deleted 2y ago
    [deleted]
  - Teever 2y ago
    Surely that must afoul of some sort of French laws regarding accessibility? How are blind people supposed to use this UI?
    - vladvasiliu 2y ago
      To be honest, I'm neither a web dev/designer nor do I have bad sight, so I admit I don't really know how accessibility works. I expect this to be compatible with screen readers somehow, they even say they take this seriously. But from a quick glance at the Accessibility tab in Firefox, I see many complaints about "interactive elements must be labeled". Obviously, if the computer reads aloud the password as you type it, it's an absolute win for security, and I'm sure some PMs somewhere are quite content with a job well done. For the curious, here's the login page: https://mabanque.bnpparibas/fr/connexion https://mabanque.bnpparibas/fr/connexion
      - 2y ago
fragmede 2y ago
I had that problem with a major US bank. Copy and pasting or retyping the password worked, because doing so hit the client side JavaScript that truncated the password. If the password manager filled it out, it wouldn't work because it bypassed that JavaScript.
MSFT_Edging 2y ago
At some point paypal had a character limit on the password, but wouldn't warn you when you set the password. So I set a long password, and was denied entry when using it, until i figured out the limit. Ex, i created the account with "mySuperAwesomeHunter2Password". But the limit was somewhere in the middle so I had to enter "MySuperAweso" to log in. They fixed it since then but I stopped using it except as a payment proxy. No money will ever be stored on paypal after that nonsense.

deleted 2y ago

[deleted]

dilawar 2y ago

This is nothing. My bank account (HDFC india) starts with 00. Dare send it to any accounting person who will copy paste it into an excel sheet and bang.. the prefix 00 is gone. Now they will complain that your account details are wrong. Took me a few months to figure out what was really going on.

ctxc 2y ago
Not to mention the disabled copy pasting.
ryoshu 2y ago
Had a similar thing happen when my small regional bank was rolled up through a couple M&A's and I have 00s and my regional account number remained. If I ever have to call them I have to explain the situation because when I start with 0s they don't believe me.
toss1 2y ago
Yup. Here in USA, Citizen's bank, iirc a subsidiary of Royal Bank Of Scotland, has had a bug for years that prevents me from changing my password. The only way to do it is via a series of tech support calls, despite the fact that they've had an open ticket for years. The source of the problem? Can't do it on an account where the email address (not the username) has a less-than-3-character-long name, as in "ab@mycomain.com". I own a small company and setup initials for easy-to-use email addresses, and found zero problems anywhere else in the world. But these clowns seem to need "abc@..." to function correctly. I've found bankers tend to not be the brightest bulbs in the box, and this is but one example.

hypercube33 2y ago

Up until a few years ago WF didn't process case in passwords. you could set your password to Hello and log in with hello

vonrosen2000 2y ago

I think Bank of America doesn't allow exclamation mark in password. It is strange. One of the largest banks on earth.

DarkUranium 2y ago

My own bank used to have [A-Za-z0-9] passwords with a character limit + browser certificates. I thought the former was pretty bad (and it's always alarming, as it tends to imply they're storing it in plaintext if they even care what the characters are ...). Then they got bought by another bank ... and now, they require *6-digit* PINs/passwords + no certificates. Yes, there's 2FA involved now, but seriously, 6 digits?