31–40 of 61 posts
Charles Schwab takes long password but truncates them at 8 characters without telling you. I discovered this the hard way by trial and error when linking it in Quicken.
I like the idea. I think it would be nice to also include sites that store passwords in plain text. I always email sites if they send me my password in plain text. Half the time they reply and say it's not really so bad. Half the time they reply and clearly don't understand why I would even care. I've yet to see anyone admit that it's a problem. If we get could get that solved, that would really be nice.
Just 2 days ago, I got a call from Natwest bank (UK) from the credit card fraud team. Again. I duly called back and they explained that an attempt to use my card online failed at the Secure Code step. I explained to the caller that Secure Code is a piece of rubbish because it uses very weak passwords (alphanumeric only, 8 chars long) and it's the equivalent of protecting my money by wrapping it in a piece of paper. I…
It is actually kind of secure because the card processor never gets or knows your extra code, but the implementation is atrocious since it requires the website wanting your money to display a webpage from your bank. The odds of that page integrating nicely with the website's payment flow is kinda non-existant, and always sets my fraud alert spinning.
Just 2 days ago, I got a call from Natwest bank (UK) from the credit card fraud team. Again. I duly called back and they explained that an attempt to use my card online failed at the Secure Code step. I explained to the caller that Secure Code is a piece of rubbish because it uses very weak passwords (alphanumeric only, 8 chars long) and it's the equivalent of protecting my money by wrapping it in a piece of paper. I…
It's the same as Secure3D for Visa, right? It is actually kind of secure because the card processor never gets or knows your extra code, but the implementation is atrocious since it requires the website wanting your money to display a webpage from your bank. The odds of that page integrating nicely with the website's payment flow is kinda non-existant, and always sets my fraud alert spinning.
ING's isn't a password it's a PIN number. That's why you can't use any letters or special characters.
That is kind of true - ING do call it a PIN. The thing is that all I can do with the PIN is to log on to their online banking site. That makes it a password in my opinion. If I want to use my card at an ATM say, they require me to use a different PIN.
Earlier quoted context omitted.
That is kind of true - ING do call it a PIN. The thing is that all I can do with the PIN is to log on to their online banking site. That makes it a password in my opinion. If I want to use my card at an ATM say, they require me to use a different PIN.
And the penalty for typing in the wrong PIN at an ATM is presumably a lot higher than providing the wrong PIN on their website, which means the feasibility of a brute force attack (which is what password complexity is all about) is entirely different.
I was thinking of creating a list like this of all the sites that (most likely) store passwords as plain text. I'd get the list by doing a password reminder and seeing if they email me my password. Would be cool if that was added as a column here. I'd submit some sites.
Just 2 days ago, I got a call from Natwest bank (UK) from the credit card fraud team. Again. I duly called back and they explained that an attempt to use my card online failed at the Secure Code step. I explained to the caller that Secure Code is a piece of rubbish because it uses very weak passwords (alphanumeric only, 8 chars long) and it's the equivalent of protecting my money by wrapping it in a piece of paper. I…
It's the same as Secure3D for Visa, right? It is actually kind of secure because the card processor never gets or knows your extra code, but the implementation is atrocious since it requires the website wanting your money to display a webpage from your bank. The odds of that page integrating nicely with the website's payment flow is kinda non-existant, and always sets my fraud alert spinning.
One example of extreme login security that I've seen is with treasurydirect.gov. Password: min 8 char, 1 letter, 1 number, 1 special. Mailed key card: 7 x 5 alpha numeric grid with a random 3 char series ((A2, G5, F5) for example), 1 out of 3 sets of 10 digit numbers on your key card, 3 security questions on unrecognised computers (out of around 10 - you must remember which 3 questions you set and answer them appropr…
Earlier quoted context omitted.
Requiring long passwords is a restriction that leads to a more secure password. This site (it's called weakpasswords) is about restrictions that make your password less secure. The site for my credit card requires a password that is no more than 6 characters -- talk about insecure.
The site for my credit card requires a password that is no more than 6 characters -- talk about insecure. Not necessarily. Oftentimes banks will set a hard limit on the number of unsuccessful attempts you can make before they lock you out entirely. Then you have to phone them and jump through a number of hoops to prove you are who you say you are, and then reset the password. If they do a really good job preventing b…
PIN requires you to possess a card with the account details and relevant security data. Yes they're clonable but you can't do a distributed attack on thousands of accounts that way.
Online, as many banks have leaked customer data, one can use a botnet to try common passwords against thousands of customer accounts (you may need to get account data elsewhere to do this or customer numbers may be guessable). 6 chars severely limits the passwords to try.