6 ms·
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this i
by fdej 12y ago
They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
- dougedey 12y agoMy bank (TD Canada) used to have this policy. Luckily it changed. However, they didn't tell me (or anyone) so I've been telling everyone I know to update their password to be longer.
- abdullahkhalids 12y agoThanks for the tip. I almost refused their online banking service because of the short password length.
- randlet 12y agoTD's password is still HORRIBLE. It is case insensitive and ignores anything after the first 8 characters and doesn't allow special characters. If my password is "aBc123De" I can log in by entering the password "ABC123DEFOOBARBAZ".
- jrockway 12y agoBetter than idiotic websites that enforce their character length limit on the client, but not on all pages on the client. So you can change your password to 123456789, but the login page will truncate it to 12345678
- dougedey 12y agoI just tested this, it is case sensitive and it doesn't ignore things after 8 characters. I'm using TD Canada, not sure if they've maybe updated since you tried?
- randlet 12y agoStrange. I tried just this morning before posting but I will update my password and try again. edit: after updating my password it's now case sensitive, and allows special chars. As the sibling comment suggests, it looks like they have two different authentication routes and updating your password moves you onto the newer one.
- johnbellone 12y agoPerhaps this[1] has something to do with it? [1]: http://stackoverflow.com/questions/2179649/are-passwords-on-modern-unix-linux-systems-still-limited-to-8-characters http://stackoverflow.com/questions/2179649/are-passwords-on-...
- etimberg 12y agoI tried it with a new password today. The requirements were between 8 an 32 characters and some special characters allowed. I just tried with all lower case letters and it rejected it. Prior to changing my password however, I experienced everything you described. They must have 2 systems and setting a new password must switch you to the new system. Can't fathom why they don't just mandate everyone changing their passwords.
- randlet 12y agoYup this appears to be it. I just changed my password and can now use a longer password with special chars (no spaces though).
- etimberg 12y agoI didn't know they changed their policy, so thanks :). Their old policy stripped out capital letters too which made it even less secure. Sadly it still doesn't allow all special characters, but it's a start.
- raesene3 12y agoVery likely to be a legacy back-end system. Doesn't excuse it at all, but that's one I've seen limit banking systems in the past either in password length, complexity or case sensitivity (I've seen some systems automatically upcase passwords without telling you 'cause the back-end is case insensitive)
- a_bonobo 12y agoSame goes for Virgin Mobile (at least here in Australia), which ALSO requires you to only use numbers. Last week they forced me to change my password due to an "important change" - ascending or descending numbers were not allowed anymore. I guess they had a look at their plain text password database and realized that 99% of their users used 123456. Edit: Australia seems to be using the US system: http://www.bitdefender.com/security/hacking-virgin-mobile-user-accounts-too-easy-dev-says-due-to-six-digit-passwords-number-only-pins.html http://www.bitdefender.com/security/hacking-virgin-mobile-us...
- V-2 12y agoGiven that they've requested you to change password to conform to the new rule, I believe you were within these 99%? ;)
- nwh 12y agoNo, it could have just been random. They've reduced their keyspace massively by doing that. Six characters, all numbers, no ascending or descending. 123849 is invalid as an example, as is 954391.
- deleted 12y ago[deleted]
- Shivetya 12y agoso 741963 would pass? Not sure how that rule your stated actually functions, I am probably over thinking it. I am curious what simple pattern people will adapt to once you eliminate simple sequences. It has got to be predictable, as in someone could put math behind it.
- nwh 12y agoAny run of three characters in sequence, forward or reverse, is marked as invalid. 123 876 432 would all mark the whole password as invalid, even if they only take up half the string. Yours would pass though, yes.
- acheron 12y agoFinancial company I use apparently shares the same password between their web site and their automated phone system. So in addition to a max length of 10 or 12, you can't use anything non-alphanumeric since you wouldn't be able to enter it with a phone keypad. Also rules out stored a hashed password, too. Terrible idea all around. (Edit: ok, I guess they could convert the PW to the phone key version when initially setting the PW, and then store both the hashed text PW and hashed phone key PW. So not "rules out". I just doubt they do it.)
- robryk 12y agoEven if they do, acquiring both of these hashes vastly helps with brute-forcing: you first break the phone key password and then check only the alphanumeric passwords that match it against the alphanumeric password's hash.
- raverbashing 12y agoI believe this is to allow alternate inputs of data, like "fill in the 2nd, 5th and 6th character" or special keyboards in ATMs, like "Press the arrow that contains the 1st letter of your password" But yeah, it's stupid
- mcv 12y ago6 characters for a bank password?! Get a better bank! It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.
- Kudos 12y agoThat's nothing, mine's a 5 digit pin code which they only validate 3 of in a random order (to annoy keyloggers, I assume) plus the last 4 digits of my phone number. Edit: This feels like the scene where Mel Gibson and Rene Russo compare scars in Lethal Weapon 3.
- dave84 12y agoSounds like AIB. If you use the app they don't even ask for the last 4 digits of your phone number.
- Kudos 12y agoBingo. I wonder what their brute force protection is like, but I'm not going to go pentesting the login of a company I'm in the same legal jurisdiction as.
- maaarghk 12y agoYeah, similarly, Lloyds/HBOS in the UK do allow you to have a master password but you also need to fill out a "memorable information" where you select 3 random characters from a second password. But you don't type them, you select them from a drop down. I can see how this would annoy the most basic of keyloggers but it is also a UX disaster and not suitable for decent loggers. Pisses me off.
- nchlswu 12y ago> My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database. and legacy security policies/requirements that have not undergone any update. I've worked on a project that touched banking passwords in the past and in a push for modern password requirements (which was met....somewhere in the middle), the response was that since the number of attempts was so restricted (and claims about whatever security/fraud engine they were using), the risk caused by the restrictive passwords were essentially negated. From a security perspective, how true is this? I'm genuinely looking to be educated. It did seem like a reasonable measure to prevent a bruteforce attack, but I'm not sure if I'm missing anything
- Afforess 12y agoHow true is this? Bullshit. Sure, it's secure from a front-door perspective. But if say, a future unpatched software vulnerability leads to the password hashes being leaked (a when, not an if) the 6 letter password hashes are going to be mighty easy to crack.
- wlesieutre 12y agoFor a system that limits passwords to 6 letters, I bet they weren't hashing them to begin with. But maybe nchlswu fixed that.
- danielweber 12y agoHow often do major US banks have their password tables leaked? When was the last time it happened?
- radicalbyte 12y agoActually, having weird password requirements might make them, on average, more secure. Why? Because the passwords will be different. The average person uses the same password over many sites. The chances of one of those sites being hacked/rogue is 100x higher than the bank getting hit. Weird requirements = different password = more secure.
- KMag 12y ago
- mitosis 12y agoThat could well be it. My bank enforces similar short passwords, but they're not such a big security risk since they lock the account after three mistakes, and require you to visit a branch in person to reactivate it. I guess that means they're wide open to denial of service attacks, but that's another story.
- jchung 12y agoI would be very interested to hear a first-hand account from the developer who gets the requirements and has to actually build in these types of password restrictions. Did you object? Does anyone recognize how absurd it is?
- fuzzix 12y ago> stored as a char(6) Try PIC X(6).
- hluska 12y agoMy bank enforces a six character limit and the passwords aren't even case sensitive. But, brace yourself to feel safe - they make me answer a security question (in this case, "What high school did you go to?" They made a (record) four billion dollar profit last year, so this strikes me as security designed by someone with an MBA and a spreadsheet. I'd be upset, but, I've been stupid enough to keep doing business with them...
- lurkinggrue 12y agoOr they have a web front end that goes over to an old mainframe.
- tzs 12y agoI don't buy that as an explanation for ridiculous password limitations. It is true that mainframe timesharing systems often had password requirements that are considered weak by today's standards. However, there is no reason for bank customers to even have accounts on the mainframe. Bank customer accounts have nothing to do with mainframe user accounts. There is no good reason for any mainframe password restrictions to leak into the public facing web front end. To the mainframe, the web password should just be a data field in a database [1], and mainframe databases can easily handle data fields of sufficient length to support modern password best practices. [1] Or rather, the output of hashing (with something like bcrypt or better) is just a data field in a database.
- lurkinggrue 12y agoI agree but it wouldn't surprise me if they did it all wrong and were just passing credentials.