News for hackers. Stuff that matters.

A comment on Two Canadian banks say accounts compromised: CIBC 40,000 and BMO 50,000. Parent comment

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by 52-6F-62 on Monday May 28, 2018 @09:47PM (#17175864)
[Source: I have a Tangerine account]

The password size is fixed at 6 integers. No more, no less.

[ Parent | on HN ]
Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by developer2 on Tuesday May 29, 2018 @04:09AM (#17177262)
It's actually worse than that. It's fixed 4-digit or 6-digit. Most customers probably use the same 4-digit password for online/telephone banking as they use for their debit card's PIN. I don't care what legacy software the backend is built with; a 4-digit or 6-digit numerical password should frankly be an illegal way for a bank to do business.
[ Parent | on HN ]
Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by brownell on Monday May 28, 2018 @11:09PM (#17176189)
So 1 million possible passwords? That's straight-up terrible entropy these days.
[ Parent | on HN ]