Change your Last.fm password

Oh, I fully believe that whatever ancient mainframe they are using might limit passwords to some small number of mono case characters with no funny characters allowed.

However, that would only apply to passwords for mainframe accounts. The bank is NOT going to be creating a login account on the mainframe for each bank customer. Our bank accounts are just entries in an application database on the mainframe.

If there is some kind of per customer password that the mainframe stores with the bank account data and that the online system has to provide when sending transactions to the mainframe, and it has such a limit, and the bank cannot update the application and database for some reason, that still should not be visible to the customer doing online banking.

The part the customer sees online should have its own password database, which allows good passwords, and in there it should have (encrypted!) whatever the ancient limited mainframe password is for that customer's account.

Unless the web interface itself runs on an ancient mainframe, I strongly suspect that there is no acceptable excuse for only allowing short passwords from a limited character set.

Banks are simply not very good at security, or they don't care. Hell, they insist on mailing me things that include my full credit card number, ensuring that someone who wanted to inconvenience me just has to drive by my mailbox at the right time and steal my statement. How freaking hard would it be for them to X out all but the last 4 digits. Yes, that would mean someone whose statement covers multiple cards might have a collision--so don't issue two cards with the same last 4 to two people who receive a joint statement.

I had some questions about whether using an md5sum as the bcrypt input, with much less keyspace (only hex characters) had any impact on security but nobody could/would answer.

I'm guessing that knowing that the plaintext for the bcrypt hash is always going to be 16 characters of 0-9,a-f might have some impact on crypto analysis but considering the passwords most people use I'm guessing it's only going to be a net win in terms of entropy.

To delete your Last.fm account, go to the "Data" tab in settings. Click on "Delete entire account for user".

A long time ago, I signed up to PerkMonks for some unimportant reason. Since it was unimportant then (and still is now) I used my then-standard "throwaway login". Sometime later, and before it became "a thing", I signed up for this new "microblgging service" using my "throwaway login" - it was called Twitter - nobody much had heard of it back then. Fastforward 3 years or so… Twitter had become, while not _important_, at least a place where I consider my personal reputation is important. Shortly after the PerkMonks user database got exposed (with it's cleartext passwords! facepalm!), I got an early morning text message from a friend "Acai berry spam from your Twitter account! Ha ha!" (Thanks Colin… For both the heads-up and the deserved ridicule)

If you're using the same "throwaway" credentials in a bunch of places you consider "unimportant" - make sure you upgrade those to properly secure credentials when the importance of those places changes.

Or better still, get 1Password/KeyPass/LastPass/WhatEver and stop doing that…

# Note though, that you need at least 20 printable ascii chars to get the 128 bits of entropy possible in an MD5 hash, so for _most_ passwords, you could optimize your cracker by only bruteforcing bcrypt(salt, md5/sha1(password)) using shorter strings as password guesses rather then needing to bruteforce the whole 128 bit MD5 space. With bcrypt and salt though, that turns into an "only practical for state-level attacker" I think.