News for hackers. Stuff that matters.

A comment on Stop forcing arbitrary password rules. Parent comment

Re:Stop forcing arbitrary password rules by qb45 on Saturday October 24, 2015 @07:59AM (#10443332)
Now this reminded me of one Unix server operated by an educational institution that shall remain unnamed, where passwords were (maybe still are?) truncated to 8 characters. Fortunately, this wasn't a problem because as long as the first 8 characters matched you could type literally anything and the password would get accepted.

Funnily, the admins apparently really cared about security very much, so they required users to change passwords every few months. It was possible to change asdfghjk to asdfghjkl and keep logging in with asdfghjk. I kid you not.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by mikeash on Saturday October 24, 2015 @09:38AM (#10443548)
There is a bank which shall remain nameless (<cough>Schwab</cough>) which not only silently truncates passwords to 8 characters, but also performs a case insensitive match.

They say they're working on fixing it but it's taking an awfully long time.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by breischl on Saturday October 24, 2015 @10:49AM (#10443751)
Last I checked, Fidelity truncates to 10 characters, but silently converts them all to digits. They map them all to their equivalents on a typical phone keypad... so it's not even using all the digits. Talk about awful security...

Edit to add: It appears they may have fixed this misfeature. I did personally verify that you could log into their website with the phone-equivalent digits at one point, maybe a year or two ago. There's also a few forum threads about it around the net, eg https://www.bogleheads.org/forum/viewtopic.php?t=93792#p1350...

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Retric on Saturday October 24, 2015 @10:42AM (#10443728)
As long as you throttle login attempts short passwords are fine. EX: 6 digit pin on a debit card might seem useless, but if you only get 3 tries per day that's just not an issue.

~10-20 failed attempts per day per IP + some rules to check for multiple IP's per account and 8 lowercase letters - most common passwords is actually reasonable.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Estragon on Saturday October 24, 2015 @04:26PM (#10444733)
> As long as you throttle login attempts short passwords are fine.

Not if the password-hash database leaks.

[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by Houshalter on Saturday October 24, 2015 @08:32PM (#10445431)
If someone has hacked into your bank, you have bigger problems than the hackers knowing your password.
[ Parent | on HN ]
Re:Stop forcing arbitrary password rules by mikeash on Saturday October 24, 2015 @12:35PM (#10444097)
I can buy that argument in general. But silently truncating is indefensible. What if I had a long password which started with my name or something, but which I believed to be secure because it had secret stuff at the end?
[ Parent | on HN ]