News for hackers. Stuff that matters.
Re:Big U.S. Banks Are Stiffing Account Takeover Victims by spaetzleesser on Friday October 07, 2022 @03:58PM (#33126200)
Is there any reason why they limit the length of passwords or don’t allow certain characters? It makes no sense to me.
Re:Big U.S. Banks Are Stiffing Account Takeover Victims by WorldMaker on Friday October 07, 2022 @04:38PM (#33126612)
As fun general rules of thumb:

Hard 8 character limits are often a side-effect of old COBOL "databases" in the backend somewhere.

Hard 16 character limits are sometimes a side-effect of old versions of Active Directory in the backend somewhere or new versions of Active Directory in certain backward compatibility operation modes/certain group policies.

Hard character limits in general are often a sign that someone is storing the plaintext somewhere they shouldn't be.

(Soft character limits today are mostly to avoid possible hash function DDoS.)

Re:Big U.S. Banks Are Stiffing Account Takeover Victims by EvanAnderson on Friday October 07, 2022 @04:54PM (#33126746)
The 14 character password limit in some versions of Windows is a side effect of using LM and NTLM (original "flavor", not NTLMv2) hashes used in Windows NT domains and maintaining compatibility therewith. It's not related to Active Directory, per se.

Nobody should be using LM or NTLM hashes anymore today, for all that that means... >sigh<

Re:Big U.S. Banks Are Stiffing Account Takeover Victims by freeone3000 on Friday October 07, 2022 @04:13PM (#33126355)
It's so you can enter your password over a touch-tone phone.
Re:Big U.S. Banks Are Stiffing Account Takeover Victims by wlonkly on Saturday October 08, 2022 @06:40PM (#33136722)
Shared credentials with phone or ATM banking.