Hacker News Reader

Comment by the_french | Hacker News Reader

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

View on HN

Well Westpac had an onscreen keyboard for the password entry too until about 18 months ago. When they finally replaced it with a (thankfully password-safe friendly) text box they had this to say:

"At Westpac, we are continually striving to provide the highest quality service and security to help support our Online Banking customers.

From the end of May 2018, we will be removing the keypad from the online sign-in screen and replacing it with an open text box, which allows you to type in your Customer ID and password.

...

Security Guarantee. We assure you that using the open text box to enter your sign-in details carries the same high level of security ..."

Passwords remained fixed at 6 characters however.

The US treasury does/did this on-screen keyboard thing as well (at least up until I stopped needing to login to that website within the last year or two). The "best" method I had around it was to copy the password out of my manager, use developer tools to find the '<input type="password">' element, and add 'value="[paste]"' manually.

I used to bank with WestPac and from memory it wasn’t possible to do this as they had some additional javascript running that would cipher every letter.

I got firefox to remember passwords for a couple sites that were blocking autofill. It involved opening up the xml file where passwords are stored, copying the latest entry, changing the url and ID number, then opening up the password manager in firefox and updating the actual password there since the XML file only stores an encrypted version. It wouldn't autofill instantly, had to click on the username box to get it to work but it saved me a lot of time from entering a massive password that system required.

This is common in Brazil as well. Allegedly they are trying to avoid keyloggers. Obviously people just improved keyloggers to take screenshots at precise times.

Reply on news.ycombinator.com