Digital Identity Guidelines: Public Comment Period

Re:Digital Identity Guidelines: Public Comment Period by will_hughes on Monday March 13, 2017 @01:07AM (#13855367)

Customer Reps of any kind almost certainly have no idea about security. At best they'll ask their manager/helpdesk, who'll say "Just reply that it's based on industry standards" or something like that.

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by Freak_NL on Monday March 13, 2017 @06:18AM (#13856543)

Customer service at banks tend to reply "for safety reasons" to any question you pose about their antiquated password limitations. A password limit of 20 characters? That's for safety reasons. Which safety reasons? We can't tell you, because of safety reasons.

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by AckSyn on Monday March 13, 2017 @07:22AM (#13856814)

> We can't tell you, because of safety reasons

Reminds me of another "security" organization.

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by mfukar on Monday March 13, 2017 @06:42AM (#13856635)

Just so I know what bank(s) to avoid, which one is (or are) this?

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by Freak_NL on Monday March 13, 2017 @08:09AM (#13857030)

ING in the Netherlands. Although to be fair, most banks have outrageously backwards password rules, and most limit the maximum length to something like 20 characters.

[ Parent | on HN ]

Re:Digital Identity Guidelines: Public Comment Period by will_hughes on Monday March 13, 2017 @09:21PM (#13864162)

tl;dr: All of them.

Try it, ask your bank why they impose a limit of N characters for their passwords (I bet N is < 30 characters).

You'll almost certainly get a response along the lines of "We follow industry best practice" or something.

[ Parent | on HN ]