Two-factor paper passwords

Re:Two-factor paper passwords by dfox on Tuesday May 03, 2016 @09:58AM (#11620678)

That is valid question to ask authors of systems that do not allow passwords longer than 12 characters (or 8, which is another popular upper limit, which can have some vaguely meaningful technical reason for legacy systems).

[ Parent | on HN ]

Re:Two-factor paper passwords by zo1 on Tuesday May 03, 2016 @12:04PM (#11621830)

Or 10, which is the maximum password length my bank requires in order to log in to my bank account.

Oh, but they have a 4-digit pin, too! That makes it oh so much more secure.

[ Parent | on HN ]

Re:Two-factor paper passwords by nommm-nommm on Tuesday May 03, 2016 @12:13PM (#11621916)

My old bank required an exactly 5 character password.

They had two factor authentication though, with a phone call or SMS. What happened if you forgot your password? Well you had to reset it, using only phone call/SMS, of course!

[ Parent | on HN ]

Re:Two-factor paper passwords by vacri on Tuesday May 03, 2016 @11:42PM (#11626009)

Banks are more willing to eat the fraud costs involved with real-world compromised PIN codes than to deal with the customer support for forgetful users.

[ Parent | on HN ]

Re:Two-factor paper passwords by gambiting on Tuesday May 03, 2016 @11:35AM (#11621549)

Our HR management system at work, that manages all payslips and tax returns only allows passwords between 8 and 9 characters, they have to start with a letter, they have to contain one of the following "@", "_", "-", "$", but no other special characters are allowed. It has to contain one number.

It's the most bizzare password requirement I have ever seen and I am pretty sure it's not secure. Have I mentioned it only works in IE and uses ActiveX controls?

[ Parent | on HN ]

Re:Two-factor paper passwords by mikestew on Wednesday May 04, 2016 @12:54PM (#11629669)

only allows passwords between 8 and 9 characters

Inclusive, I hope.

[ Parent | on HN ]

Re:Two-factor paper passwords by jacobr1 on Tuesday May 03, 2016 @10:15AM (#11620843)

Often that is the size of the DB column and the password is stored in plaintext (or was and the size restriction remained).

[ Parent | on HN ]

Re:Two-factor paper passwords by jsingleton on Tuesday May 03, 2016 @12:04PM (#11621827)

This is usually the case but there are frequently short length restrictions even when it's hashed. Sometimes only on the client side too, so you can just remove the attribute from the input.

[ Parent | on HN ]

Re:Two-factor paper passwords by pavel_lishin on Tuesday May 03, 2016 @12:15PM (#11621944)

As I understand it, those restrictions are typically due to having an interface with some legacy system where those restrictions can't be removed.

[ Parent | on HN ]

Re:Two-factor paper passwords by swang on Tuesday May 03, 2016 @12:41PM (#11622197)

because a lot of companies have no technical expertise at all.

american express use to enforce insane limits on passwords back in 2010[0]. 6-8 characters for passwords, no special character and had to have 1 letter, 1 number and it wasn't case sensitive. unfortunately _I_ had an amex card.

that page i linked to also has a reply from amex support who shows little knowledge about the difference between passwords and website encryption.

they eventually started expanding that limit from 6-8 characters to 8-20 characters around 2012? 2013?

[0] http://securitywatch.pcmag.com/e-commerce/284119-amex-passwo...

[ Parent | on HN ]