Dumb Password Rules

Re:Dumb Password Rules by lorenzhs on Monday December 05, 2016 @11:42AM (#13106679)

My bank limits passwords to at most 5 alphanumerical characters. Yup. Five. There are over ten times more possible customer IDs (10 digits) than passwords.

[ Parent | on HN ]

Re:Dumb Password Rules by vinay427 on Monday December 05, 2016 @11:43AM (#13106686)

Out of curiosity, what bank is this?

[ Parent | on HN ]

Re:Dumb Password Rules by lorenzhs on Monday December 05, 2016 @11:48AM (#13106734)

The Sparkassen in Germany do this, but they're not alone in doing so. They lock you out after a couple of attempts, so brute-force is out, but it's still dumb.

[ Parent | on HN ]

Re:Dumb Password Rules by clarkcox3 on Wednesday December 07, 2016 @07:04PM (#13127387)

> so brute-force is out

Until someone gets ahold of a list of the hashed passwords and can brute force them at home without triggering the lockout.

[ Parent | on HN ]