Hacker News Reader

Comment by imaginenore | Hacker News Reader

If your password is even 10 characters (alphanum, upper and lowercase = 62 characters), it's already safe enough for the most sites that properly hash your passwords and don't allow many attempts.

Passwords for more sensitive sites, like banking, should be longer of course, 20 characters gives you 119 bits, 30 characters gives you 178 bits.

View on HN

lol my bank only accepts 4 digit numbers passwords.

My credit union used to have a similar, although not as bad, password policy. I believe password length had to be between 8 and 10 alphanumeric characters, and then there were other crazy rules that reduced the entropy of passwords further. I think there had to be at least 3 numbers in the password and it couldn't start with a number.

It took them years before they finally listened to reason and allowed you to have a stronger password

My (new) bank USAA has some password policy which I forget, but I vaguely remember the green bar growing longer as I typed in my proposed password.

To log in to the site I have to supply my login/password, then on the next page my 4 digit pin, then on the next page the answer to one of three rotating security questions.

On the phone app, after the phone was authenticated the first time, I only have to enter my 4 digit pin to access my account. IIRC, that policy is at my option.

I'm not sure if that's all a good thing, or theater, but that's what they have.

Reply on news.ycombinator.com