Hacker News Reader

I wouldn’t use a bank with this attitude. With a “tech company” label comes a lot of unjustified hubris based on an assumption that one is good at everything just because they write code.

My employer called themselves an education research company that happened to use software to commercialise their findings. It sat a lot better with me and made for better culture in my eyes.

View on HN

I have been using Wells Fargo for almost thirty years and while I don’t know if it’s still the case, as recent as four years ago their passwords were case insensitive. I’ll take a little sane fintech in my banking please.

Why is case sensitivity in passwords important?

If your answer is: because 62^8 (^12, ^16) is much bigger than 36^8 (^12, ^16) then I assume you don't actually know how people crack passwords, which isn't brute-force.

If your system is capable of being brute-forced, you already failed, because there's no reason to give someone enough guesses that a brute-force approach succeeds.

That particular detail is not dangerous in and of itself, but it is an embarrassing, public "code smell" because it indicates they are going cowboy mode and implementing weird ideas in their code even when it comes to authentication and cryptography.

Reply on news.ycombinator.com