Hacker News Reader

Comment by dspillett | Hacker News Reader

> You cannot enter a password with more than X chars

I've seen this from banks, for access to my money & credit...

Both FirstDirect and HSBC used to have a 9 character password for their "digital secure key"s (basically their apps on my phone, in the direct use use-case). 9. Just 9. Though at least alpha-numeric & case-sensitive, so some room for reasonable entropy.

Worse: for some reason HSBC recently changed theirs to 6 numeric characters. 6. Numeric only. And while forcing me to change, they repeatedly assured me that this was just as secure as before… Luckily for me all I have with them currently is a mortgage that I'll be paying off in (checks calendar) a week and a half, at which point the whole lot gets closed and they can make it a two digit PIN for all it'll affect my financial security!

(UK here, not sure if they have different restrictions in different territories but I suspect not)

View on HN

>Worse: for some reason HSBC recently changed theirs to 6 numeric characters. 6. Numeric only. And while forcing me to change, they repeatedly assured me that this was just as secure as before… Luckily for me all I have with them currently is a mortgage that I'll be paying off in (checks calendar) a week and a half, at which point the whole lot gets closed and they can make it a two digit PIN for all it'll affect my financial security!

I'll one-up you: Nationwide requires six numeric characters, which you have to enter via one 0-9 dropdown menu per digit, and you only have to enter three per login.

i.e. if your "passcode" is 987654, then it will randomly choose only three of those for you to enter, like

    _?_??_

where you'd only have to put in 8, 6, and 5. So it's clearly stored in plaintext. And they have 2FA, but as you might expect, it's SMS only.

And their online banking site is garbage, some links just always timeout and log me out.

Is there a single UK bank that has the following two features: 1) lets me pick a sane password and has non-SMS 2FA, 2) has an online banking interface that works on desktop browsers.

The second one is important to me because I never want to do banking on my phone. Last time I checked, the "challenger banks" like Monzo only have phone options.

I'm absolutely sure banks store passwords in plaintext more often than not. But then one particular bank takes the cake. There, I have:

- The usual login + password, the password length is limited of course

- The "secret questions" to confirm some actions. In reality these are just three extra passwords

- The code generator in the mobile app to confirm some other actions, for access to which you need a 4-digit pin code

Another bank is much more sensible in this regard but requires me to change my password every year. I hate it with a burning passion when there's any time component at all in user authentication.

Sky (Germany) has 4 digit codes for their accounts. Ridiculous.

Reply on news.ycombinator.com