Hacker News Reader

Comment by delecti | Hacker News Reader

My bank introduced "usernames" at some point, breaking login with email addresses, but didn't document this fact, or enforce that usernames not be set to email addresses. For a few months, every time I went to login, I had to use the "find my account" function, and each time I would again set my username to my email address (and why wouldn't I, it had been my login credential for nearly a decade by that point). At no point did it ever enforce a restriction on the @ or . in the username, until I went to login. It took me literal months to figure out and set it to something else.

This is Capital One by the way. My account was originally ING Direct, then Capital One 360, before being fully incorporated into the rest of their nonsense, and I assume that's related to the username situation.

View on HN

This is nothing.

My bank account (HDFC india) starts with 00. Dare send it to any accounting person who will copy paste it into an excel sheet and bang.. the prefix 00 is gone. Now they will complain that your account details are wrong. Took me a few months to figure out what was really going on.

Not to mention the disabled copy pasting.

Had a similar thing happen when my small regional bank was rolled up through a couple M&A's and I have 00s and my regional account number remained. If I ever have to call them I have to explain the situation because when I start with 0s they don't believe me.

Yup.

Here in USA, Citizen's bank, iirc a subsidiary of Royal Bank Of Scotland, has had a bug for years that prevents me from changing my password. The only way to do it is via a series of tech support calls, despite the fact that they've had an open ticket for years. The source of the problem? Can't do it on an account where the email address (not the username) has a less-than-3-character-long name, as in "ab@mycomain.com". I own a small company and setup initials for easy-to-use email addresses, and found zero problems anywhere else in the world. But these clowns seem to need "abc@..." to function correctly.

I've found bankers tend to not be the brightest bulbs in the box, and this is but one example.

At a Mexican bank, Banregio, there was a character limit to the username on mobile but not on web. So I originally had a username that was accepted at registration but not when I tried to log in on my phone and it wouldn’t allow me to input my entire username.

Edit: The issue was with the password field, not the username.

USAA had a similar issue for some time, but with the password field. One interface (web or mobile, I don’t remember) would silently truncate the password. You couldn’t even tell it was being truncated because it was all **!

Actually, looking at the credentials in 1Password for this bank, my issue was with the password field, so similar to USAA. Mobile had a 15 character limit.

Speaking of character limits, my bank, Swedbank Latvia, used to have a 16-character limit on passwords. After lots and lots and lots of pestering over various channels, they finally fixed it. But the "fix" was to add a maxlength attribute on an input field. So the field will accept the 16 first characters and ignore the rest (password fields are masked so the user cannot see the field is not accepting their input). So yes, I could now set my password to "SwedbankSecurityExperts", yay. But I could later log in with "SwedbankSecurityIncompetence" as well...

Well, 16 isn't so bad. Here, in France, BNP accounts must have exactly six digit passwords. They're also incompatible with password managers: you have to click the number on a visual number pad.

Surely that must afoul of some sort of French laws regarding accessibility?

How are blind people supposed to use this UI?

To be honest, I'm neither a web dev/designer nor do I have bad sight, so I admit I don't really know how accessibility works. I expect this to be compatible with screen readers somehow, they even say they take this seriously. But from a quick glance at the Accessibility tab in Firefox, I see many complaints about "interactive elements must be labeled".

Obviously, if the computer reads aloud the password as you type it, it's an absolute win for security, and I'm sure some PMs somewhere are quite content with a job well done.

For the curious, here's the login page: https://mabanque.bnpparibas/fr/connexion

La Banque Postale actually has a toggle button to make the computer read the code out loud as you type it.

It's no big deal... you'd need to be blind to miss someone nearby listening in!

Maybe it's a French law or something.

I've had business and personal accounts with SG, La Banque Postale, BoursoBank and CIC and they all worked with those 6-character "visual number pad" logins.

I doubt it. N26, which is granted a "new bank", doesn't have that, even though it now has an actual French subsidiary, complete with French account numbers. My password with them is way above 6 characters, and contains numbers, letters and symbols. The login page has a regular password field.

I think the others are just copycats. Someone must have come up with this first, and the others figured "yeah, that looks so secure, let's do that, too". If I had a penny for every CSO who justified some stupid "security" idea with "everybody does it, why shouldn't we?" I'd be so rich I wouldn't care about this crap anymore.

At least you can login. Alipay in China has (or had, it's been a while) a max length of about 16 characters for your full name, but when linking to your bank account it compares with the whole string, so any name longer than 16 characters will always return false.

I've spent a lot of time in China over the years and most of their tech systems are built on the assumption that only Chinese folk will ever use it. In this case, the vast majority of Chinese people have a 2, 3 or 4 character name ('why would you EVER need 16, silly 老外?')

It's a bit of a 'Foreigner in China' stereotype to whine about how absurdly difficult it is to go to e.g. the bank or a hospital as a non-native because it happens so often.

The character limitation is also a problem in Korea. The thing that makes it worse is that your name on your alien registration card (think Green Card) is used to open your bank accounts. If they don't match you'll have a hell of a time doing any sort of online or mobile transaction since the systems are tied together. Only recently some banks have recognized this as a problem and extended the number of characters allowed.

Japan also has this issue.

I had that problem with a major US bank. Copy and pasting or retyping the password worked, because doing so hit the client side JavaScript that truncated the password. If the password manager filled it out, it wouldn't work because it bypassed that JavaScript.

At some point paypal had a character limit on the password, but wouldn't warn you when you set the password. So I set a long password, and was denied entry when using it, until i figured out the limit.

Ex, i created the account with "mySuperAwesomeHunter2Password".

But the limit was somewhere in the middle so I had to enter "MySuperAweso" to log in.

They fixed it since then but I stopped using it except as a payment proxy. No money will ever be stored on paypal after that nonsense.

I think Bank of America doesn't allow exclamation mark in password. It is strange. One of the largest banks on earth.

Up until a few years ago WF didn't process case in passwords. you could set your password to Hello and log in with hello

My own bank used to have [A-Za-z0-9] passwords with a character limit + browser certificates. I thought the former was pretty bad (and it's always alarming, as it tends to imply they're storing it in plaintext if they even care what the characters are ...).

Then they got bought by another bank ... and now, they require *6-digit* PINs/passwords + no certificates. Yes, there's 2FA involved now, but seriously, 6 digits?

Reply on news.ycombinator.com