3 ms·
I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their
by mistercow 14y ago
I actually emailed my credit union, pleading for them to increase their 10 character limit to something reasonable, and got a response saying that the way their database handles passwords made it impossible.
Needless to say, I found that to be even more disconcerting than the existence of the character limit.
- qiemem 14y agoCHAR(8)
- mistercow 14y agoWorse yet, it seems to imply that they aren't hashing, which is simply preposterous for a financial institution.
- codesuela 14y agoMany banks require you to use numbers only for your pin a smart engineer probably figured that cracking 10 char numerical "passwords" is trivial so hashing would be a waste of resources and hence energy and emissions. It is greener that way.
- gweinberg 14y agoDon't worry too much about it. It's vastly more likely that it's actually their change policies that make the increase impossible.
- mistercow 14y agoYes, probably, but it's still scary that whichever technical person they asked thought this would be an OK answer to give someone who is reporting security concerns.
- randomdata 14y agoMy credit union enforces similar limits (and only 0-9 are valid characters), but I realized the validation was only enforced in Javascript. I disabled the validation and I was able to use any password I wanted.
- eru 14y agoDid you try any SQL injection attacks?