4 ms·

Thanks for posting, I've passed this on to my contact at Schwab to see if it can get fixed properly ;)

• colinbartlett 12y ago
  It appears a lot of people have already warned Schwab about this. Sadly, I expect it will change only if there was some embarrassing large scale attack that is subsequently publicized.
  • thrownaway2424 12y ago
    How would such large scale attack be perpetrated? The worst you could do would be to lock out a lot of accounts.
    • cddotdotslash 12y ago
      If someone managed to steal a database of credentials from Schwab, they could possibly decrypt the passwords (all these limitations clearly point to them not hashing properly). If someone stole a database from a provider that implements passwords correctly, the best they could do is get some low-hanging fruit passwords.
• nhstanley 12y ago
  This has been a problem for years that they refuse to fix. The legacy password thing (Strike one) is bullshit, they could just force everyone to update their passwords when they implement a properly designed system. I would be even more disheartened if customer complaints and an article in Ars can't get this fixed, but someone "passing it on to a contact" could. It's disgusting that this is how they've handled it. I minimize how much money I keep with them and will be closing the account when I get back to the States.
  • bhartzer 12y ago
    I understand your frustration, but let's see how 'passing it on to a contact' will (or will not) work in this case.