6 ms·

I remember being shocked when I realized that Charles Schwab, a bank that manages untold illions of dollars, was ignoring everything after the 8th character in

I remember being shocked when I realized that Charles Schwab, a bank that manages untold illions of dollars, was ignoring everything after the 8th character in their passwords. This was still true until a few years ago.

jp191919 2y ago
Transunion (credit reporting agency) does this, but after the 15th character.
happymellon 2y ago
As did HSBC.
doubled112 2y ago
A bunch of the Canadian banks too. TD Canada Trust I can personally confirm.
- astrange 2y ago
  This is a sign they're storing it unhashed on a mainframe system. Airlines also do it.
  - KMnO4 2y ago
    That’s not true. You can hash the truncated version
    - computerfriend 2y ago
      The desire to truncate comes from wanting to store smaller fields in the database.
myrandomcomment 2y ago
I remember this. I had enough funds with them at the time (and I am also in tech so I insisted on a technical explanation) that I was able to speak with their security team about the reason for the limit and when it would be fixed. It has been fixed and they require 2FA now (however they require a very specific app for it). Overall my experience with them over the last 10 years has been good. TLDR; limit on older mainframe system, however password were properly hashed & they plan to remove the limit in the next year, which they did.
dpkirchner 2y ago
Wait til you see what Fidelity does.. https://www.fidelity.com/customer-service/faqs-managing-your-profile https://www.fidelity.com/customer-service/faqs-managing-your... > Usernames and passwords containing letters need to be translated to numbers to enter them in a Fidelity phone system (like FAST®, or if you call a representative). Use your telephone keypad to convert the letters to numbers. There is no case sensitivity. Substitute an asterisk (*) for all special characters. Here's an example: > To enter a username, e.g., Smith123, press or say 7-6-4-8-4-1-2-3 > To enter a password, e.g., Lucky1$23, press or say 5-8-2-5-9-1-*-2-3
- brokenmachine 2y ago
  Lucky my password is very secure, "ÈÍ§¾÷øÏ¡þää£àèÀ¸Àþ¡ï×ÕÞ£¸«"

jp191919 2y ago

Transunion (credit reporting agency) does this, but after the 15th character.

happymellon 2y ago

As did HSBC.

doubled112 2y ago

A bunch of the Canadian banks too. TD Canada Trust I can personally confirm.

astrange 2y ago
This is a sign they're storing it unhashed on a mainframe system. Airlines also do it.
- KMnO4 2y ago
  That’s not true. You can hash the truncated version
  - computerfriend 2y ago
    The desire to truncate comes from wanting to store smaller fields in the database.

myrandomcomment 2y ago

I remember this. I had enough funds with them at the time (and I am also in tech so I insisted on a technical explanation) that I was able to speak with their security team about the reason for the limit and when it would be fixed. It has been fixed and they require 2FA now (however they require a very specific app for it). Overall my experience with them over the last 10 years has been good. TLDR; limit on older mainframe system, however password were properly hashed & they plan to remove the limit in the next year, which they did.

dpkirchner 2y ago

Wait til you see what Fidelity does.. https://www.fidelity.com/customer-service/faqs-managing-your-profile https://www.fidelity.com/customer-service/faqs-managing-your... > Usernames and passwords containing letters need to be translated to numbers to enter them in a Fidelity phone system (like FAST®, or if you call a representative). Use your telephone keypad to convert the letters to numbers. There is no case sensitivity. Substitute an asterisk (*) for all special characters. Here's an example: > To enter a username, e.g., Smith123, press or say 7-6-4-8-4-1-2-3 > To enter a password, e.g., Lucky1$23, press or say 5-8-2-5-9-1-*-2-3

brokenmachine 2y ago
Lucky my password is very secure, "ÈÍ§¾÷øÏ¡þää£àèÀ¸Àþ¡ï×ÕÞ£¸«"