Hacker News Reader

Comment by moltar | Hacker News Reader

Recently tried to login into PC Financial MasterCard online account. And got “your password is too long” error. What? Right! Password length validation on the login form!

I called CS and explained that this is impossible as I use a password manager and it worked just not long ago. They assured me that this was always the case and that I’m an idiot for forgetting my password.

They sent me to password reset procedure page.

The password procedure emails plain text temporary password, which then let’s you pick a new password.

When picking a new password, I tried to enter my old password that was too long, just for the heck of it, to see if it’d go thru.

Lo and behold, the system answered that I “cannot reuse the same password as previous 6 passwords”.

That’s banking-grade security right there.

View on HN

My bank has a password length limit of 8 characters.

Do they throw up an error? No, they silently truncate it.

The cherry on top is that it’s also case insensitive.

I stick with them because they’re good otherwise and they make it clear that they take responsibility for any losses due to this nonsense. But holy crap, “bank grade security” is definitely not a positive thing in my eyes.

I feel the term "bank grade security" used to mean something before we were banking online. "Bank grade security" conjures images of actually having to physically go to your bank and then having your money stored in a vault.

Def not the case anymore.

There is no cloud, just other people's computers.

Is the validation done using Javascript? I have used a credit union that used to do that until they merged with another credit union and switched to a new system. Password requirements were limited to 0-9, maximum of six digits. However, if you bypassed their client-side validation logic, you could use any password you wanted.

I have the same PC MasterCard, but in the PC Bank website that was replaced by Simplii, I found that the last character of my password, a period, did not matter to get logged in. I could enter it, or not. It worked either way. Perhaps something similar is happening for you.

What is wrong with stopping people from reusing the same password? It can be done securely using the same storage mechanism as passwords, ie storing hashes only.

The point was that the system knew his too-long password and the password was correct, just being suddenly rejected on the frontend, unlike what support said.

First mistake? PC Financial.

Reply on news.ycombinator.com