Hacker News Reader

My credit union enforces similar limits (and only 0-9 are valid characters), but I realized the validation was only enforced in Javascript. I disabled the validation and I was able to use any password I wanted.

Did you try any SQL injection attacks?

Don't worry too much about it. It's vastly more likely that it's actually their change policies that make the increase impossible.

Yes, probably, but it's still scary that whichever technical person they asked thought this would be an OK answer to give someone who is reporting security concerns.

CHAR(8)

Worse yet, it seems to imply that they aren't hashing, which is simply preposterous for a financial institution.

Many banks require you to use numbers only for your pin a smart engineer probably figured that cracking 10 char numerical "passwords" is trivial so hashing would be a waste of resources and hence energy and emissions. It is greener that way.