Sites with dumb password rules

Re:Sites with dumb password rules by WillDaSilva on Friday September 06, 2019 @12:30AM (#20893079)

From the GitHub issue about BMO:

  The original entry didn't even fully capture the stupidity of the BMO password system (which I recognize they have now fixed).

  The most egregious part was not that your password had to be only 6 characters. It was that whatever password you chose ended up getting mapped to where those characters were on a telephone keypad. So, for example if your password was passwo, you were also able to login with 727796 or rARsYo or anything else that mapped to the same characters.

  I really should have switched banks when I found this out.

That's so strange (and awful). I wonder how they discovered that this mapping was being done.

[ Parent | on HN ]

Re:Sites with dumb password rules by sundarurfriend on Friday September 06, 2019 @12:38AM (#20893119)

The horizontal scrolling makes the quoted part pretty hard to read. If it's still editable, please consider changing that to simple `> ` based quoting.

Edit: Link to the github issue comment mentioned - https://github.com/dumb-password-rules/dumb-password-rules/i...

[ Parent | on HN ]

Re:Sites with dumb password rules by mittonface on Friday September 06, 2019 @01:01PM (#20897395)

I made this comment.

Since you're curious: I signed into telebanking and it asked for me to input my password. I didn't ever remember setting a phone password, so I tried punching in the numbers that corresponded to my online banking password. It worked.

Obviously the only way this would work is if they stored the numeric keypad representation of your password instead of your actual password. So I experimented a bit and found password horror.

[ Parent | on HN ]

Re:Sites with dumb password rules by saagarjha on Friday September 06, 2019 @12:41AM (#20893127)

Made a typo that happened to map to the same sequence on a telephone keypad?

[ Parent | on HN ]

Re:Sites with dumb password rules by dilatorily on Friday September 06, 2019 @02:44AM (#20893581)

From what I remember, their online banking system was built on their legacy telephone banking system.

[ Parent | on HN ]