6 ms·

I also noticed (and complained) that their passwords were limited to so absurdly short sequence. Not sure if it's still true. Hope not.

jbuzbee 14y ago
I just checked. Vanguard passwords can be up to 10 characters long
- kibwen 14y ago
  For perspective, this is an absurdly short sequence.
  - jbuzbee 14y ago
    You could argue that there should be no limit or maybe the limit should be higher, but I'd have a hard time arguing that a 10 character password composed of upper, lower, specials and digits is absurd
    - dbpatterson 14y ago
      You _should_ argue that there ought to be no limit. There is absolutely no reason why there should be a limit below maybe 4k (and even then, I'm not sure. Perhaps some limit if DOS is concern...). The only reason why there are limits now is that there is code running on their servers specifically stopping passwords that are longer - which is insane, if you think about it - they are actively preventing people from creating stronger passwords. I'd rather create a 20-30 character password with no specials (which is still massively harder to crack than a 10 char with all possible specials), because it is easier to type in on mobile, but with this system, I couldn't - which is dumb.
    - deleted 14y ago
      [deleted]
    - pheleven 14y ago
      They don't accept lower case - if you have capslock on you'll still be logged in. I don't think they accept all special characters either.
      - jbuzbee 14y ago
        You're right - I just tried my password using all caps instead of mixed-case - ouch!
      - davidcuddeback 14y ago
        Ouch. I didn't know their passwords were case insensitive. I thought they didn't accept all special characters either, but I just successfully changed my password with special characters that I don't remember them accepting last time I changed my password. I was successfully able to log in using a version of my new password with the case changed for some letters.
milesskorpen 14y ago
Yes, still a big issue.
natehark 14y ago
Still true. It would be nice if they offered two-factor authentication
- durkie 14y ago
  absolutely! it baffles me that vanguard is putting people in the position of trusting millions of dollars of their portfolios to username/password and a 'security image'. if i were a black hat, targeting a place like vanguard would make so much more sense than going after a bank.

jbuzbee 14y ago

I just checked. Vanguard passwords can be up to 10 characters long

kibwen 14y ago
For perspective, this is an absurdly short sequence.
- jbuzbee 14y ago
  You could argue that there should be no limit or maybe the limit should be higher, but I'd have a hard time arguing that a 10 character password composed of upper, lower, specials and digits is absurd
  - dbpatterson 14y ago
    You _should_ argue that there ought to be no limit. There is absolutely no reason why there should be a limit below maybe 4k (and even then, I'm not sure. Perhaps some limit if DOS is concern...). The only reason why there are limits now is that there is code running on their servers specifically stopping passwords that are longer - which is insane, if you think about it - they are actively preventing people from creating stronger passwords. I'd rather create a 20-30 character password with no specials (which is still massively harder to crack than a 10 char with all possible specials), because it is easier to type in on mobile, but with this system, I couldn't - which is dumb.
  - deleted 14y ago
    [deleted]
  - pheleven 14y ago
    They don't accept lower case - if you have capslock on you'll still be logged in. I don't think they accept all special characters either.
    - jbuzbee 14y ago
      You're right - I just tried my password using all caps instead of mixed-case - ouch!
    - davidcuddeback 14y ago
      Ouch. I didn't know their passwords were case insensitive. I thought they didn't accept all special characters either, but I just successfully changed my password with special characters that I don't remember them accepting last time I changed my password. I was successfully able to log in using a version of my new password with the case changed for some letters.

milesskorpen 14y ago

Yes, still a big issue.

natehark 14y ago

Still true. It would be nice if they offered two-factor authentication

durkie 14y ago
absolutely! it baffles me that vanguard is putting people in the position of trusting millions of dollars of their portfolios to username/password and a 'security image'. if i were a black hat, targeting a place like vanguard would make so much more sense than going after a bank.