Hacker News Reader

Comment by bsimpson | Hacker News Reader

You're reminding me of the time I realized that Schwab (a massive American bank/broker) truncated all passwords to 8 characters.

View on HN

Bonus points are given when they handle truncating your password differently in the initial validation vs authentication and it fails silently!

Or, even more hilariously, that said truncation happens on the client, and varies between different clients that they have. I personally ran into this with Wells Fargo, where their mobile app would leave one more (or one less, I don't remember exactly now) character than their website.

PayPal used to do the same thing, but even worse they weren't consistent about it. The page to create your password truncated it, but the login page did not. I found out the hard way when I couldn't log in because of that stupid behavior.

Thankfully they fixed it at some point, but it's absolutely mind blowing to me that anyone thought it was acceptable in the first place.

This drove me absolutely crazy as well and I was equally shocked that anyone thought it was a good idea. Ended up going through several rounds of password resets before figuring it out. Further reinforced the perception that PayPal is a crap company and continue to avoid using them as much as possible.

Heh, that's the same company that sends physical mail to me every time I make a trade because they believe that email sent to my personal domain is "undeliverable" and automatically opt me out of e-statements no matter how many times I opt-back in. They have to be losing money on me by paying for so much postage at this point.

(And no, nothing is wrong with my email, it's hosted by a professional email host with the proper MX records and literally only Schwab claims to have this problem with me).

My college had a credit union with an ATM in the cafeteria. It was in your interest to keep enough money in the credit union to pay for lunch etc. while you were a student there.

When I graduated, I pulled the money back out. Apparently they issued the final interest payment after I'd emptied the account. For at least a year after that, I got monthly statements informing me that I had an account with less money in it than the postage on the statement.

Back in the 1970s, I lived for a while in Boston. I needed both Canadian and American accounts, for reasons. So I opened an account with the Boston branch of the Bank of Nova Scotia. Things worked ok for a while, and then I moved back to Canada. I withdrew the pittance I had in the account, and asked the bank staff to close the account. For the next two years or so, I got account statements, showing the glorious zero balance. I think it only stopped when I moved and didn't notify them of a forwarding address.

Earlier this winter, I got a bunch of those letters completely out of the blue. I was also receiving emails from Schwab throughout the several weeks they were sending me a pile of letters saying they couldn't deliver emails to my address. Then the letters stopped.

A different bank that I use will occasionally tell me that I'm about to be opted out of email because I haven't opened any of their mails and they don't think they're getting through. Which I assume is just because I have thunderbird set to not show remote images and that breaks their tracking.

Hey they don't anymore so, progress!

I remember comparing notes with fellow employees at a previous job, and depending on when you'd started working, the system had different password rules for you (users who'd been created earlier had a smaller set of allowed characters, etc.). Pretty sure it worked out to some Oracle nonsense.

Years ago I found a glaring security hole in schwab where when imputing a security question answer, if you got it wrong you could just hit the back button and try again.

to their credit, they took me seriously and I believe they fixed it reasonably promptly.

Reply on news.ycombinator.com