Hacker News Reader

Comment by nicc | Hacker News Reader

My bank (Fineco) requires passwords to be 8 characters.

Yup, I don't mean minimum or maximum, but exactly 8 characters.

That's got to make brute-forcing about 1,000,000 times easier, and I cannot think of a single good reason to impose this.

I bet huge numbers are "12345678" and "password".

View on HN

BMO in Canada is the same, but six characters. And although you can use alphanumeric characters, it automatically doubles as a phone banking password, so (at least at one point) they were all translated into characters 2-9 in their system. So even online, you could log in with the phone digit equivalent of your exactly 6 digit password.

Yeah it's shitty, but I mean at least they have a 100% guarantee on all online stuff where if you didn't give away your pin/password/card, and didn't make it your name/address/number/other personal info they will refund you. Which I mean isn't much help but at least is something. I wish they had 2FA.

Banks will lock the account after a few mistakes. Even a 4 digit pin would be secure.

Well... Ok.

> I cannot think of a single good reason to impose this.

Good? Definitely not, but my money is on CHAR(8) and a lack of understanding.

> lack of understanding That is the thing... Id the programs and designers lack understanding of something as basic as passwords what else are they misunderstanding? Sql injection? My other favorite is "use only the special characters...."

Dollar to a donut, there is or was a mainframe involved in authentication that has an 8 character password. I even bet the company that sold it was IBM. I remember finding out at one job that the "reason" for the 8 character password requirement for one of our logins, was "you can type as much as you want, but eventually we just take the first 8 characters and use that to log you into the mainframe as thats all it accepts".

Mainframes are weird, and not all that dynamic.

I’ve seen limitations that even go back to paper records. I worked at a medium sized company where at least 20% of database variables were limited by the number of characters on a paper card system developed in the 50s.

Text editors still have a line at 80 characters, which comes from punch cards.

I remember DB2 had some weird limits. I think it was something like database names couldn't be more than 8 bytes, which was something to do with some filesystem on z/OS or something that couldn't have directories with names longer than that (probably not quite right, but it was something like that).

z/os, oh how I remember interfacing with thee, and hating every minute of it.

From what I remember you're spot on, every "file" or "record name"/whatever (mainframes are not unix) was restricted to 8 characters and upper case, also EBCIDIC just because IBM. So many silly legacy things around those mainframes.

That said, they literally never had an outage on it the entire time I was there so +1 for reliability and availability. They even replaced the whole mainframe piece by piece.

Reply on news.ycombinator.com