Reminds me of a password security policy that listed few SQL statements that can't be used in passwords.
That was probably to prevent SQL injection, right?
We'd lose our security certificate if we allowed pasting
131–140 of 225 posts
Re: We'd lose our security certificate if we allowed pasting
#132They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
6 characters for a bank password?! Get a better bank! It's unbelievable how bad the password policies of some banks are. Mine doesn't allow special characters, for example. Fortunately it does allow longer passwords at least.
My bank uses a 6 digits pin code...
At least you have to enter the code in a virtual numpad that is randomized after each connection on their webpage.
I guess they settled for this measure so it does not annoy their less "tech-savvy" customers. I am baffled to see banks working with such low security practices in general ("admin"-like access on your bank accounts by any employee, checking money transfers AFTER executing it,...).
Re: We'd lose our security certificate if we allowed pasting
#133Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.
It's secured by a four digit password and self destruction after three consecutive invalid PIN entries. Which is plenty secure against brute force. Or is that just the way it works around here?
A tiny number of digits combined with the standard, visible input system is a recipe for 'shoulder surfing' attacks. I'm not proposing a superior system, just pointing out that brute-force attacks are not the only thing to beware.
Re: We'd lose our security certificate if we allowed pasting
#134Earlier quoted context omitted.
> My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database. and legacy security policies/requirements that have not undergone any update. I've worked on a project that touched banking passwords in the past and in a push for modern password requirements (which was met....somewhere in the middle), the response was that since the number of attempts was so restr…
How true is this? Bullshit. Sure, it's secure from a front-door perspective. But if say, a future unpatched software vulnerability leads to the password hashes being leaked (a when, not an if) the 6 letter password hashes are going to be mighty easy to crack.
For a system that limits passwords to 6 letters, I bet they weren't hashing them to begin with. But maybe nchlswu fixed that.
Re: We'd lose our security certificate if we allowed pasting
#135Call me a conspiracy nut but after reading all the accounts of banks and companies ridiculously reducing keyspace in weird ways (give me a good legacy-tech reason for [0]...) I'm starting to believe that they're doing it on purpose.
Re: We'd lose our security certificate if we allowed pasting
#136Before laughing at how stupid this is, remember that your debit card is secured by a password that consists of exactly four decimal digits. I really wonder when this is finally going to change, but I hear some futuristic banks allow up to six digits already.
Losing passwords is bad because they get reused. 4-digit pin not so much, debit card is basically the only thing that uses it.
Not true; the password on iOS devices is a 4-digit pin; in my experience, plenty of people either reuse their bank PIN, or just use their DOB.
Re: We'd lose our security certificate if we allowed pasting
#137Earlier quoted context omitted.
It's standard security practice to disable autocomplete for secure pages.
No it's not. Most big websites (hello google!) don't do this. Why do you think it's standard?
I've done more research and it appears that browsers are handling it better ([0]), however I've had this issue raised to me before.
Re: We'd lose our security certificate if we allowed pasting
#138Earlier quoted context omitted.
> My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database. and legacy security policies/requirements that have not undergone any update. I've worked on a project that touched banking passwords in the past and in a push for modern password requirements (which was met....somewhere in the middle), the response was that since the number of attempts was so restr…
How true is this? Bullshit. Sure, it's secure from a front-door perspective. But if say, a future unpatched software vulnerability leads to the password hashes being leaked (a when, not an if) the 6 letter password hashes are going to be mighty easy to crack.
How often do major US banks have their password tables leaked? When was the last time it happened?
Re: We'd lose our security certificate if we allowed pasting
#139They probably hired the same security consultant as my bank, which requires your online password to be exactly six characters long. My hypothesis is that this is a technical limitation due to the password being stored as a char(6) in their database.
> stored as a char(6)
Try PIC X(6).