Two Canadian banks say accounts compromised: CIBC 40,000 and BMO 50,000

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by gruez on Monday May 28, 2018 @09:37PM (#17175818)

>Not minimum, limit!

1 character passwords allowed?

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by 52-6F-62 on Monday May 28, 2018 @09:47PM (#17175864)

[Source: I have a Tangerine account]

The password size is fixed at 6 integers. No more, no less.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by developer2 on Tuesday May 29, 2018 @04:09AM (#17177262)

It's actually worse than that. It's fixed 4-digit or 6-digit. Most customers probably use the same 4-digit password for online/telephone banking as they use for their debit card's PIN. I don't care what legacy software the backend is built with; a 4-digit or 6-digit numerical password should frankly be an illegal way for a bank to do business.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by brownell on Monday May 28, 2018 @11:09PM (#17176189)

So 1 million possible passwords? That's straight-up terrible entropy these days.

[ Parent | on HN ]