BMO only uses the first six characters of your password for online banking.

#1

Post by ptolts » Thu, Oct 25, 2012, 8:12 PM UTC

I was just using the BMO iPhone app to check my balance, when I mistyped my password. I had hit the final key too many times, but had already clicked sign in. To my surprise, I was logged in anyway. After testing in a browser I realized BMO only cares about the first six characters of your password.

Astounding.

Re: BMO only uses the first six characters of your password for online banking.

#2

Post by ari_elle » Thu, Oct 25, 2012, 8:36 PM UTC

Sadly this is more common than you might think and also well known

Re: BMO only uses the first six characters of your password for online banking.

#3

Post by ptolts » Thu, Oct 25, 2012, 9:06 PM UTC

ari_elle wrote: post #2

Sadly this is more common than you might think and also well known

Really eh?

Whats the point in the password strength meter!

Re: BMO only uses the first six characters of your password for online banking.

#4

Post by albumedia » Thu, Oct 25, 2012, 9:31 PM UTC

Very interesting....at least it's not 4.

Re: BMO only uses the first six characters of your password for online banking.

#5

Post by ptolts » Thu, Oct 25, 2012, 9:50 PM UTC

albumedia wrote: post #4

Very interesting....at least it's not 4.

Yeah! I've unchecked "Save my card number"

Re: BMO only uses the first six characters of your password for online banking.

#6

Post by ari_elle » Thu, Oct 25, 2012, 10:29 PM UTC

ptolts wrote: post #3

ari_elle wrote: post #2

Sadly this is more common than you might think and also well known

Really eh? Whats the point in the password strength meter!

Password strength meter not only measures length, but also encourages not to use words and to mix up letters, numbers, special characters and uppercase/lowercase letters.

Not to forget the fact that feeling safe probably is one of the biggest things the strength meter should achieve.

Re: BMO only uses the first six characters of your password for online banking.

#7

Post by Mankhool » Fri, Oct 26, 2012, 6:59 PM UTC

I thought that the limit WAS 6 characters from telephone banking days prior to online banking and mobile banking - a holdover. So when I set up online banking eons ago I used the same PW and was setup instantly. I take it new account setups are asking for a longer and more secure PW?