4 ms·

The problem isn't just hotmail. Most major banks (amex, chase, etc.) forbid special characters, limit the password length as well, or a combination of both. Th

The problem isn't just hotmail. Most major banks (amex, chase, etc.) forbid special characters, limit the password length as well, or a combination of both. Then again, banks are not exactly on the cutting edge of security, though they like to seem like they are. This isn't a surprise considering how shoddily their web apps are built.

vectorbunny 14y ago
I was recently setting up an online account with Charter because my wife and were having issues with the irregular nature of their paper billing. After securing the PIN number that was only on the paper bill that they weren't sending us, I created the account with a 30 character password string that was generated and stored within Password Gorilla. Charter's webapp took the password, which was to long for them, and instead of throwing an error and telling me to choose a shorter password, it truncated it at some arbitrary position to fit their policy. Locked out! Ten minutes get to a human on the phone, another five to explain why someone would use a 30 character password and how they might go about doing it... eventually the password was reset. Good times.
jrockway 14y ago
Then again, banks are not exactly on the cutting edge of security, though they like to seem like they are. Every bank I've ever dealt with has assumed 100% liability for unauthorized transactions, so a bad password affects them financially, not you. Therefore, I don't understand all the complaining about password length.
- meritt 14y ago
  That's a pretty damn naive statement. Yes, in the end, customers are financially protected. But that doesn't make up for the hours, days or even weeks of phone calls, emails, letters, in-person visits, credit-reporting agency fixes, etc which are necessary to rectify fraud in the banking/finance industry.
- chc 14y ago
  A friend of a friend recently had $500 stolen and Chase didn't reimburse him for that, so this doesn't seem to be universal. (On the other hand, Bank of America did issue me a temporary credit for my money that got stolen in the same compromise, so I know it happens sometimes.)
- tjoff 14y ago
  And if it affects them financially you can count on that being forwarded their customers...
- nnnnni 14y ago
  Even if they assume 100% of the liability, it's still a PAIN to deal with stuff like that.
kmfrk 14y ago
Airlines, too. I recently had to enter an alphanumeric password at or below around 12 characters, I think. Some companies also add so many requirements to the password that I think it does more harm than good to the entropy of it.
- Steko 14y ago
  For many web services entropy isn't a big deal because they use computationally hard hashing functions and have sensible server-side limits that outright foil brute force attempts.
  - ams6110 14y ago
    until their hashes show up on pastebin
    - Steko 14y ago
      Entropy and work factor are basically the same thing, that's why they call it key stretching.
- celer 14y ago
  I recently was forced to enter a password of not more than 8 characters as part of college applications. I was somewhat flummoxed, because the disposable password I use for applications I want to be able to forget about is nine characters. That is the lowest I have ever seen: I hope that there is noone worse.
  - olivier1664 14y ago
    Have you try to enter some quote in your password? http://xkcd.com/327/ http://xkcd.com/327/

vectorbunny 14y ago

I was recently setting up an online account with Charter because my wife and were having issues with the irregular nature of their paper billing. After securing the PIN number that was only on the paper bill that they weren't sending us, I created the account with a 30 character password string that was generated and stored within Password Gorilla. Charter's webapp took the password, which was to long for them, and instead of throwing an error and telling me to choose a shorter password, it truncated it at some arbitrary position to fit their policy. Locked out! Ten minutes get to a human on the phone, another five to explain why someone would use a 30 character password and how they might go about doing it... eventually the password was reset. Good times.

jrockway 14y ago

Then again, banks are not exactly on the cutting edge of security, though they like to seem like they are. Every bank I've ever dealt with has assumed 100% liability for unauthorized transactions, so a bad password affects them financially, not you. Therefore, I don't understand all the complaining about password length.

meritt 14y ago
That's a pretty damn naive statement. Yes, in the end, customers are financially protected. But that doesn't make up for the hours, days or even weeks of phone calls, emails, letters, in-person visits, credit-reporting agency fixes, etc which are necessary to rectify fraud in the banking/finance industry.
chc 14y ago
A friend of a friend recently had $500 stolen and Chase didn't reimburse him for that, so this doesn't seem to be universal. (On the other hand, Bank of America did issue me a temporary credit for my money that got stolen in the same compromise, so I know it happens sometimes.)
tjoff 14y ago
And if it affects them financially you can count on that being forwarded their customers...
nnnnni 14y ago
Even if they assume 100% of the liability, it's still a PAIN to deal with stuff like that.

kmfrk 14y ago

Airlines, too. I recently had to enter an alphanumeric password at or below around 12 characters, I think. Some companies also add so many requirements to the password that I think it does more harm than good to the entropy of it.

Steko 14y ago
For many web services entropy isn't a big deal because they use computationally hard hashing functions and have sensible server-side limits that outright foil brute force attempts.
- ams6110 14y ago
  until their hashes show up on pastebin
  - Steko 14y ago
    Entropy and work factor are basically the same thing, that's why they call it key stretching.
celer 14y ago
I recently was forced to enter a password of not more than 8 characters as part of college applications. I was somewhat flummoxed, because the disposable password I use for applications I want to be able to forget about is nine characters. That is the lowest I have ever seen: I hope that there is noone worse.
- olivier1664 14y ago
  Have you try to enter some quote in your password? http://xkcd.com/327/ http://xkcd.com/327/