Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone.

So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!

What banks do this? AFAIK, Wells Fargo doesn't care about case-sensitivity but that's it.

that's disgusting :-/

/that noise when your head hits the desk

I don't want to enter my password on the phone, I have fingerprint or pin in mobile banking app.

He meant over the phone, not on a phone.

Ex : I call my bank and I have to go through a menu leading me to the right agent. Eventually, it asks for my password over the phone that I need to type using the 10 numbers on a phone dial.

Good luck using your fingerprint there :)

For that i have separate numeric only password in my bank which is different than my web login password. So bank is saving couple of bucks to reuse same weak password that can be stolen on web and then used by attacker to authenticate as me over the phone. What a crappy bank. I am just happy that bank that I use is having all set better.

Source?

BMO in Canada forces 6 digits or alphanumerics as your account password. No more, no less.

What's worse, because it can be entered on the phone, aAbBcC are all == 1. So it's really just 6 digits.

Somewhere, in the background, there's a poor old unix mainframe running Cobol, unaware that the world around it has changed, and that it should put to pasture, where it can live out the rest of its days in peace.

I've heard of a bank actually trying to use that excuse when asked why their online banking passwords were so limited.

That is, of course, complete bullshit.

Sure, it is plausible that a bank has an old mainframe handling their accounts. It is also plausible that user account passwords on that old mainframe are only 6 or 8 characters and from a limited alphabet.

What does that have to do with customer online banking accounts? Nothing!

When you open a bank account they don't make a user account for you on their mainframe. What they make for you is an entry in an application database that their banking applications use. The only mainframe user accounts involved are the account that the database runs under and the account that the banking application runs under, both of which are the same for all banking customers.

Even if, for some strange reason, they do actually have to make a mainframe login account for each banking customer there is no reason for the banking customer to ever directly access that. Online banking is accessed through the web, so only the web server needs to access your banking account on the mainframe. They could make the website have its own password system, without the mainframe login restrictions. The restricted mainframe login information would only be known by the mainframe and the website back end. The banking customer should never deal with that.

Worse, it's probably an emulation of a Unix mainframe running the original Cobol code - with the emulator running in machine generated JavaScript in Nodejs on AWS...

(Obligatory xkcd comic: https://xkcd.com/1926/ )

No, more likely it's a newer IBM mainframe, as those are built to be backwards-compatible with software written back in the 60s.

A large bank in the uk runs their core software on AS400s emulating a 1401. Their ledger software is almost 60 years old.

"Unix mainframe" is something that never really existed, mainframes run special operating systems like z/OS. (You can run SuSE on a virtual partition under z, but not natively, and it is a recent concept.)

I signed up for a US BMO account for the sign up bonus... Man is that bank's website bad. The version of jQuery they are using is from 2008 (1.3xx IIRC) and they give you a pop-up if you try to right click saying "right-click has been disabled for security purposes."

To be fair though, at least they offer the guarantee that if your online banking is hacked they will reimburse 100%. Though not sure how truthful it is having never needed it.

https://i.imgur.com/O2eOwLw.jpg

Edit:

"You may be liable for all losses from unauthorized use of your Account if you:

contributed to its unauthorized use; used a PIN combination selected from your name, telephone number, date of birth, address, or Social Insurance Number; did not use reasonable care to safeguard your Secret ID Code; did not keep your Secret ID Code separate from your Card; did not comply with your reporting obligations in Section 11 of this Agreement unless there were exceptional circumstances for your failure to do so; or shared a mobile device that you registered with us for Electronic Banking Services. In those cases, your liability may exceed the funds in an Account, your credit limit or any daily transaction limits. In other words, your liability will not be limited by your Account balance, your credit limit or any daily transaction limits. You must cooperate and assist in any investigation that we initiate into the unauthorized use you reported, which is a precondition to being reimbursed for any losses. This cooperation may include filing a report with law enforcement authorities."

Overall seems fair enough protection.

I think I'd rather risk some money to hacks on an otherwise more secure system than look forward to whatever hellish phone support calls and hoop-jumping I expect I'd have to go through to get charges reversed.

Ok this sounds like a terrible question but how do they stop people from "hacking" themselves...

How do insurance companies stop people from emptying their house and then burning it down? How do brick and mortars prevent people from paying with photocopied money? It is fraud, and it is generally illegal. Huge amounts of money is spent on detecting and deferring fraud attempts.

It's entirely possible to claim your card was skimmed and have your bank refund the money. However, if they then find out that the ATM used to withdraw your entire balance is the same ATM you've used for years, and your face is on the ATMs security camera at the time of withdraw, then you're in for a world of hurt.

You basically need to file a police report about the theft, and the bank will probably know where the money was sent/spent, and the police ideally would investigate and subpoena the records of wherever the money went and presumably discover if it goes back to you somehow. The first liability thing says you cannot have "contributed to its unauthorized use". I mean realistically someone could possibly do it and get away with it, but I mean people could realistically do many types of fraud. Most could realistically probably get away with it. It's more a guarantee to people that if they get hacked somehow other then giving naughty little Johnny/vindictive ex Jane the bank card and pin, they can get their money back.

Insurance fraud is illegal; you can go to jail for it.

It just took my terrible python program 9 seconds to guess 999999.

> my bank has a max password length of 12

Look at Mr. PrivateBanking over there, my one is 5. Amount in words : Five.

And that is after they updated all their software and moved to a new datacenter and everything recently.

Granted I have a hardware dongle to authenticate any transactions, but to gain access to all my information, five characters is all the protection they wish to offer...

Why are you still with them?

In Germany is the same with Sparkasse, the largest retail bank in the country. username + 5 digits is enough to open your bank statements.

My bank only recently upgraded max password length from 8 to 12. Oh, and no special characters please.

By "special character", do they mean punctuation? Or the null byte?

I played Eve online for a while.

My corp (guild for non-Eve players) had a better and more secure login & SSO system than either my bank or my employer. My employer has replaced their SSO system by now, but my bank is still in the 90s.

Your bank password is probably not even case sensitive: http://www.zdnet.com/article/surprise-online-bank-passwords-...

Offenders: Wells Fargo, Chase, American Express, Fidelity, ....

I know of at least one bank that requires your password to have exactly one digit. Not one or more, exactly one.

This is AWESOME!

"The future is already here — it's just not very evenly distributed." - William Gibson