Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Schwab password policies and two factor authentication

jeremytunnell.com

Post reply on HN
Print view View original

81–90 of 127 posts

Re: Schwab password policies and two factor authentication

#81

Post by arenaninja »

akerl_ wrote: post #78
arenaninja wrote: post #55

Earlier quoted context omitted.

I love the arbitrary restrictions that all these sites come up with that ultimately make them less safe. Yesterday I was setting up some stuff for somebody who knows nothing about tech. IIRC it went like this: * Google: no restrictions, as far as I could tell. * Apple: password not accepted because it MUST contain at least one uppercase letter. Of course, simply knowing that one of the characters MUST be an uppercase…

Let's not get crazy here: knowing that one of a variable number of characters is uppercase does decrease the keyspace, but it's definitely not a "significant" reduction. The main problem with restrictions like that is that it complicates the UX by requiring somebody to tweak their password manager's generator or its output to match the bogus restriction.

Agreed on password manager, but I still think the decrease is significant. I won't run my mouth further and might try to quantify that decrease over the holidays.

Re: Schwab password policies and two factor authentication

#83

Post by dmix »

kevinburke wrote: post #80

I had pretty much the same experience with Virgin Mobile last year (passwords limited to 6 digits, no brute force protection). I finally told the guy I got escalated to that if they didn't do anything I'd call the NY Times, Consumerist, Gawker, CNET, Ars, etc and tell them about it. They didn't do anything, so I sent around the article and pretty much every publication I sent it to ran with it. After that they took d…

Hmm, this might motivate me to take my complaining about security beyond twitter.

Re: Schwab password policies and two factor authentication

#84

Post by darken »

cddotdotslash wrote: post #48

I just called Schwab about this, and hand to whatever deity you believe in, this is what he told me: Representative: "One of the things we were trying to do with these passwords was make them different from other providers. So we know that they allow multiple character types, and are case-sensitive, so we decided to make them different. That way, you can't use the same password you've used elsewhere and it kind of fo…

This justification actually makes some sense to me (Software engineer familiar with crypto.)

If an attacker already has access to the password hashes, then yes, they can brute force any 8 character case-insensitive password easily.

However, a brute force "try to login to their site" attack isn't feasible without hitting a rate limit or alarm: (26+10)^8 = 2.8*10^12 is still a lot of attempts to login to an account.

The weakness to this model is the password. It is easiest to guess your password if it was the same one on your Sony account (i.e. leaked). However, if you're forced to pick a unique password just for Schwab, it's immune from the most common [citation needed] attack on passwords. Also, it makes the Schwab password useless for hacking other databases, making user passwords a less valuable target for hackers.

If the tradeoffs are worth it: I have no idea, but it's not without merits. I personally like using a password manager with 2-factor authentication and generating all new random PWs for my accounts. I generally don't use more than 8-character passwords, since they're isolated from each other anyways. I would be negligibly less secure using this with Schwabs constraints than other sites, as the security lies in isolating passwords. (I use https://lastpass.com/)

Re: Schwab password policies and two factor authentication

#85

Post by jkupferman »

Fidelity had a similarly terrible password policy (6-12 characters, only letters and numbers). I complaining to their tech six months ago and got a stock "we're looking into it" answer. In the past month they've actually fixed the issue and now require 6 characters (upper case, lower case, number and symbol).

Re: Schwab password policies and two factor authentication

#86

Post by akerl_ »

arenaninja wrote: post #81
akerl_ wrote: post #78

Earlier quoted context omitted.

Let's not get crazy here: knowing that one of a variable number of characters is uppercase does decrease the keyspace, but it's definitely not a "significant" reduction. The main problem with restrictions like that is that it complicates the UX by requiring somebody to tweak their password manager's generator or its output to match the bogus restriction.

Agreed on password manager, but I still think the decrease is significant. I won't run my mouth further and might try to quantify that decrease over the holidays.

I like round numbers, so lets say that we've got 26 lowercase, 26 uppercase, 10 numbers, and 18 symbols, for a total pool of 80 character options. For our single lame character, you're stuck with 26. All calculations are rounded off to make them a bit less insane to read.

Assuming a 10 character password, there are 1.07 × 10^19 combinations without the restriction, 3.5 × 10^18 combinations with the restriction.

If we're dealing with a 24 character password, like my password manager slings out, it's 4.7 × 10^45 vs 1.5 × 10^45.

As you can see, it definitely reduces the keyspace, but when you look at the overall impact it's rather small.

Re: Schwab password policies and two factor authentication

#87

Post by colinbartlett »

feld wrote: post #58
timeal wrote: post #32

This story needs to be upvoted 1000 times. Why are financial institution so _bad_ at password policies?

Probably mainframes that they can't get rid of, or systems emulating / used to working with them.

I presume they "can't" because it's too expensive?

How expensive is too expensive for some of the richest companies in the world?

Re: Schwab password policies and two factor authentication

#88

Post by arenaninja »

akerl_ wrote: post #86
arenaninja wrote: post #81

Earlier quoted context omitted.

Agreed on password manager, but I still think the decrease is significant. I won't run my mouth further and might try to quantify that decrease over the holidays.

I like round numbers, so lets say that we've got 26 lowercase, 26 uppercase, 10 numbers, and 18 symbols, for a total pool of 80 character options. For our single lame character, you're stuck with 26. All calculations are rounded off to make them a bit less insane to read. Assuming a 10 character password, there are 1.07 × 10^19 combinations without the restriction, 3.5 × 10^18 combinations with the restriction. If we…

In both cases, the decrease you quote is about sqrt(10). It does taper off when you do a 24 character password (which is about the range of what I would choose), but it's still 30%; 70% of a large number is a large number. Typical users are not so technical as to use a 24 character password and therefore, in an unsalted leak, after the rainbow tables stage, it makes it 30% easier to brute-force them (going by your numbers).

Re: Schwab password policies and two factor authentication

#89

Post by psykovsky »

MichaelGG wrote: post #67
psykovsky wrote: post #40

Earlier quoted context omitted.

How about the case insensitivity on the passwords? How does that fit with DES encryption, or any kind of encryption at all?

User friendliness. FB did something similar where they'd store several versions of your password. That way they could tell if you had caps lock on or other problems.

You really used facebook as a best practices example? Where is the source code of facebook's function that deals with case insensitive passwords? How can you be sure such source code is actually being used in production? It's as good as plaintext without any of those assurances...
Post reply on HN