Or worse, they truncate your password after you've already used it for years and years.
I had a 30-character password with Bank of America. Somewhere along the line, it changed its password requirements to only allow a maximum of 20 or 25 characters (I forget), which automatically invalidated my password.
The password was stored in my password manager, so I knew I wasn't entering it wrong.
BoA support said I should use the "change password" feature to update my password, but I couldn't because it requires me to enter the old password, which it would not accept. For some reason I can't remember, I couldn't use the "forgot password" feature. Maybe it also didn't work right.
I spent an entire day on the phone getting bounced from person to person before finally someone was able to take a new password over the phone.
Since Bank of America can't figure out how to build a web site login, I no longer trust it with my money. I emptied that savings account and paid off the credit card as quickly as I could. I no longer use BoA.
Worse than that must be the sudden realization that your bank probably saves your password in plain text somewhere.
hash($password) == $storedhash
hash(substr($password,0,20)) == $storedhash
Fidelity is a superior experience in nearly every way - just categorically. I'm not sure if people just don't know that you can use Fidelity this way?
The only downsides are no local branches, but that's hardly an issue unless you need a cashiers check. In those rare cases you can spin up an account at shitty bank, get the check, then close the account. I've had to do that maybe once ever.
Phone call support has been surprisingly good whenever I’ve needed it.
When I used standard banks they often forced me to go in at difficult hours to do basic things and it took forever. They also had lots of fees (and as suggested in the parent comment, bad software)
Most brokers have some kind of cash account and they're always better than banks and almost always better than credit unions.
I recommend keeping a credit union account open too so you have a local branch if you need something in person.
You answered your own question.
Is there something banks like BoA do better that I'm missing? When I've asked people I know this I haven't gotten any good answers. I'm genuinely asking.
My impression is that BoA, Wells Fargo, etc. mostly take advantage of customers that don't know better options exist.
For me, Fidelity is a non-starter, for reasons that are none of your business.
It's nice that you like Fidelity. But it's a good idea to recognize that your finances and life situation are unique to you.
Lots of people talk about finances online. See r/personalfinance or r/financialindependence. It’s a good way to learn.
I cannot convey 50 years of my financial life, experience, and history into what fits in an internet post. Anyone who can probably has a very narrow view of finance. I can say that I know how to manage my finances, and my accountant agrees with my methods and track record.
But if you think Reddit is the route to financial literacy, I can understand why you don't understand.
Apparently there is a limit of 20 characters for the password. The password I set was 21 characters (which was accepted without error).
When I tried to log in with this password, the login was rejected.
However if I log in with just the first 20 characters of the password, it works.
Even worse is when the password change form accepts more characters and processes them correctly, only to have the login form not allow you to enter all characters. If I'm not mistaken, the business remote deposit portal my bank uses does this.
Once I had a password accepted with non-alpha numeric characters which were considered invalid as input on the login screen and so even though my password was correct it would not let me log in because it was validated with different logic after creation.
Another issue I've seen is that the password was required to have only a certain subset of non-alphanumeric characters, but it did not explain or validate this client side so I had a password for which all the boxes turned green, but was still invalid.
In both cases only trial and error worked to find a valid password.
Now, sites that treat email addresses as case sensitive - those are evil.
After changing it I got locked out of my account and had to call support to resolve the issue. The worst part was that after verifying my identity over the phone they kept sending me reset links and I kept using long passwords generated by 1Password (30 characters IIRC) and it always accepted them when resetting but still would never let me log in.
It took many attempts and new reset links until they suggested trying a shorter password, which was eventually accepted both during reset AND login. Of course the reset page didn't mention a maximum length.
One of my favorites was Nintendo's user account. The web allows decent passwords when created, but then the actual game console only has room for inputting 15 characters or so for the password :@
Bingo. Super frustrating.
See also this comment: https://news.ycombinator.com/item?id=24827031
That was likely fixed a long time ago, but I'm still wary of increasing my Microsoft passwords past 12 characters.
(This isn't to excuse silent truncation.)
They're stored in a password manager, but they're typeable if needed. My "security question" answers (mother's maiden name, etc) are generated the same way, unique per use, and also stored in my password manager.
Most sites don't need 128 bits of entropy. But things like banking or subscriptions should have at least 112 bits of entropy. And it's easy to just set the generator to 10 words by default.
It's a lot nicer being able to check if I typed in my Peacock login at my parents home at a glance versus a string of random characters.
In most cases I just comply with their dumb policy and put a snarky comment for my future self in the Notes field of my password manager and it makes me feel better.
Is correct-horse-battery-staple guaranteed secure to the heat death of the universe? No, but good enough that it'll take a targeted attack several months to guess.
On the other hand, "rundown skyline pluck shawl pastrami radar refueling poach prankster durable" is far easier to type and is about the same entropy
https://github.com/redacted/XKCD-password-generator
Not sure how many bits a "good" password should be nowadays.
But the point is that you don't control the website's hashing algorithm, or whether they hash at all, or whether they store their hashes in a public s3 bucket. They may tell you what they do, they may not. But you have to trust them either way.
A long random password using a variety of characters is the only control I have when setting my password. If they have a good hashing system and protect their hashes, my long random password will not hurt anything. If they truncate my password before hashing, it will still be the best password I can make for that app.
If I use 5 5 letter words as my password and they truncate after the first 10, how would I know? My password might be "horseapple" instead of "horseapplehappygreennymph".
If I give them 10 alphanumerics and they leak their md5 hashes, I'm pwned in a few days, assuming they even salt it.
If I give them 20 random alphanumeric+symbol then I can't imagine what exotic thing they could do wrong to make it less safe than any other password I choose.
I might make an exception for some streaming service that I have to enter by hand on a tv remote control, but otherwise i am going to generate it with max entropy because I am never going to look at it anyway.
There are many scenarios where an attacker might be able to grab the hashes, but still need to crack them in order to get access to other data from your account. If there is a sql injection vulnerability in the authentication service, for example, it does not mean they can necessarily overwrite the hash or access data in other parts of the application.
I once found a bug in a payment processor that let me download the user record including password hash for all users in that payment processor. But I couldn't use that to get their stored credit card numbers directly. However, if I had brute forced those hashes, I would have been able to log in as them and access their other account data and make transfers, etc. I am sure a large majority of those password would have been very easy to crack. If I was an attacker, those would have been my first targets.
I very rarely have to manually type in a password.