Hacker News Reader

Comment by RandomBK | Hacker News Reader

This is an unfortunate problem with a lot of online banking systems. The bank I use doesn't even let me use special characters in my passwords, or passwords longer than 16 characters. It's a shame that the one online system that should be the most secure has a password policy worse than a browser game...

View on HN

Yup, banks are one of the largest problems.

On of my banks forces a 4-digit, number only password, that needs to be rotated every 90 days, with no consecutive numbers, can't repeat all passwords, no numbers repeated, and a few other conditions.

Heck, even random generated numbers will fail to get accepted sometimes (1671 has two ones. 1894 has two consecutive numbers. etc).

It starts to get really hard to pick new ones as time goes by and you've already used up lots of memorable patterns.

It sounds like you'll run out of combinations in your lifetime.

A bank I once used had the online banking system tied to the card's PIN. Change the PIN, online banking password has changed. Change the online banking password and card PIN is changed. And yes, the password/PIN was limited to 6 numerical digits.

Why would you want a complex password for a bank in the first place? The only reason that would be necessary is if the bank had hopelessly woeful security and there was a risk of their encrypted passwords being stolen.

apparently you've never heard of people guessing passwords...

All the restrictions banks give don't make the password less guessable. Lots of people can still use their birth year, or their postal code. Banks are mainly a PITA, not really "securer".

There's a difference between non-complex and guessable. You don't need to have a 16+ character password to make it non guessable. My comment was referring to brute forcing rather than guessing...

My thoughts exactly. It's ridiculous.

Reply on news.ycombinator.com