Hacker News Reader

Comment by brown9-2 | Hacker News Reader

I was amazed to find one my banks (Chase) limited the password to something like 12 characters when going through this same exercise yesterday.

View on HN

The thing I found the worst about Chase is they require a number in your username. Not that the other restrictions aren't inane (6-12 char password, alphanumeric only, etc).

I know, right? And even more insane, they only allow alpha numerics, no symbols allowed. And for probably the only password which matters...

Yes, exactly. I was surprised how little correlation there was between how important the security of the site was and what quality of password was allowed by the site.

Some of that is archaic database tables (or using NIS/YP as the user manager in the backend). You didn't used to be able to start a password on AMEX's sites with a digit...

Except that they should be storing the hash anyways.

What part of archaic was clear? rpc.yppaswd isn't gone...

No bank should be storing passwords as plaintext, therefore the content of your password should not be their concern.

I don't think it's just about hashing. When I see restrictions on passwords or other fields, I always assume the worst. If < is not allowed, that's because your password will show up unencoded in HTML somewhere. If $ is not allowed, that's because somebody is afraid that it will actually be treated as a variable reference somewhere. Likewise & or % in URL-encoded data, ' or " in JavaScript, etc.

The most universal and silent restriction seems to be on NUL bytes.

Back-ended by non-RDBMS systems, the banks may be using something like YP or NIS to store passwords so that multiple systems can hit one, central authentication system. NIS had horrible password restriction issues (much like LANMAN).

I was amazed to find Paypal has a shorter limit than eBay.

To add, American Express puts a cap at 8 characters on their online services.

My bank password is 4 digits. But they ask another, one shot 4 digit password from a table they've sent to you when you actually move money. I thought all banks did this?

Mine uses an 8-digit password for the website, plus another 6-digit one for transactions. On top of that you have to authorize the computer you use (they send you an SMS with a code if you log in from a new computer).

I don't know how they uniquely identify your system, but the technology is Java-based.

Reply on news.ycombinator.com