The postbank (in the Netherlands) still have case insensitive passwords, decreasing password complexity by orders of magnitude..
ofcourse the postbank no longer exists, so you're probably talking about ingbank.nl.
Stop restricting my password - Help these sites get better security.
21–30 of 61 posts
Re: Stop restricting my password - Help these sites get better security.
#22Charles Schwab takes long password but truncates them at 8 characters without telling you. I discovered this the hard way by trial and error when linking it in Quicken.
Re: Stop restricting my password - Help these sites get better security.
#23Google, MSN, Facebook, Twitter - They all already allow you to use anything you want for your password. This is not strictly true - while Google et al might have a large set of permitted characters, there are nearly always restrictions on length. Google, for example, requires that their passwords be at least 8 characters long. While a long password does reduce brute-force attacks and shoulder-surfing, it nevertheless…
Requiring long passwords is a restriction that leads to a more secure password. This site (it's called weakpasswords) is about restrictions that make your password less secure. The site for my credit card requires a password that is no more than 6 characters -- talk about insecure.
The site for my credit card requires a password that is no more than 6 characters -- talk about insecure.
Not necessarily. Oftentimes banks will set a hard limit on the number of unsuccessful attempts you can make before they lock you out entirely. Then you have to phone them and jump through a number of hoops to prove you are who you say you are, and then reset the password. If they do a really good job preventing brute-forcing, then having an un-brute-forceable password is not necessary any more.
The easiest example of this is debit card PINs. They are usually only 4 numeric digits, and yet are trusted by banks for direct access to accounts. This is because a) banks have sophisticated systems to track brute-forcing and other kinds of abuse, b) longer pins are more prone to being written down, forgotten, and mistyped, and c) there are limits on how much you can purchase / take out per day, limiting the potential damage.
Re: Stop restricting my password - Help these sites get better security.
#24There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.
And another thing that's incredibly irritating are these stupid sites that force you to type out your password (they don't let FF write it in the text field). How is that more secure! It just forces me to either use a simple password or write it down somewhere. My normal behavior is to use a totally different password for every site and let my browser manage it.
Re: Stop restricting my password - Help these sites get better security.
#25There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.
The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.
Re: Stop restricting my password - Help these sites get better security.
#26There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.
The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.
Hmm? The hash will be a fixed length, which is the only thing you'd be storing.
Re: Stop restricting my password - Help these sites get better security.
#27Earlier quoted context omitted.
The argument I once heard for restricting length of a password (and possibly special characters) is that it would be harder to craft a buffer overflow (or SQL injection attack) with those limitations. I don't agree that this is a good solution, but it's not always good programmers/managers who are making these decisions. It at least sounds plausible.
Hmm? The hash will be a fixed length, which is the only thing you'd be storing.
In order to get that hash you'd have to process the password in its entirety. But really, if they're that concerned about the buffer I see no reason to cap it at 8 or 10 rather than 1000.
Re: Stop restricting my password - Help these sites get better security.
#28One example of extreme login security that I've seen is with treasurydirect.gov. Password: min 8 char, 1 letter, 1 number, 1 special. Mailed key card: 7 x 5 alpha numeric grid with a random 3 char series ((A2, G5, F5) for example), 1 out of 3 sets of 10 digit numbers on your key card, 3 security questions on unrecognised computers (out of around 10 - you must remember which 3 questions you set and answer them appropriately), and to top it all off, no keyboard entry - you have a randomly ordered soft keyboard that must be clicked for all password and keycard entries.
Personally, I think it's overkill, but I'll admit that I wouldn't envy anybody tasked with getting someone's account.
Re: Stop restricting my password - Help these sites get better security.
#29Just 2 days ago, I got a call from Natwest bank (UK) from the credit card fraud team. Again. I duly called back and they explained that an attempt to use my card online failed at the Secure Code step. I explained to the caller that Secure Code is a piece of rubbish because it uses very weak passwords (alphanumeric only, 8 chars long) and it's the equivalent of protecting my money by wrapping it in a piece of paper. I refuse to sign up to it or use because it is so rubbish.
He couldn't care less. So I asked him to file a formal complaint about this point. I doubt he did.
For those that want to know more about InSecureCode: http://www.mastercard.com/us/personal/en/cardholderservices/...
Re: Stop restricting my password - Help these sites get better security.
#30There's really no point in restricting length or non-alphanumeric characters. They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter. It's really just laziness and incomptence on the part of the programmers.
They should be storing a salted hash, not the actual passwords, so the content of the password shouldn't matter.
No, they should be using bcrypt. You didn't think you'd get away with this by posting after tptacek's bedtime, did you?