6 ms·

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like h

A client once had an issue where his account got compromised and everything pointed to having his actual login details leaked. His password was something like his username plus an assortment of random characters. It turned out that the system his account was on basically ignored everything after the 8th character, so that you were able to login with the username as the password. Also, during the early days of inline password generators, there were cases where the suggested password was incompatible with the associated system.

TwoBit 11y ago
That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.
- INTPenis 11y ago
  Swedbank in Sweden have a feature where you can access an accounts entire balance by generating random CC#'s for online shopping and this service is protected by your social security number, a 6 character password, a-z, 0-9 and no special characters allowed. They've had this for at least 6 years now, maybe longer. Early on when I e-mailed them about it they simply stated that it's not their service, in other words; out-sourced.
  - emerongi 11y ago
    Swedbank also requires two-factor authentication. You can bypasss this by calling them - they only ask for 1 thing to authenticate you. Two-factor authentication is rather useless if you can just bypass it like that.
    - INTPenis 11y ago
      Yes, and I had no idea they were that easy to bypass on a social level. Also this CC# generator falls outside of the 2FA scope, also something I asked them about several years ago and received the same reply "it's not our service". It's scary.
    - Zach_the_Lizard 11y ago
      >You can bypasss this by calling them - they only ask for 1 thing to authenticate you. The domain for my personal site is shared with my family. My father registered the domain and all of the details in the account use his information. I had just created an AWS account and wanted to move the site's DNS to Route53. I was able to call into the domain registrar and get exactly zero of the details correct, but they pointed the domain to Route53. It was hilarious how bad it was. I used my social, my name, my address, etc., none of which matched the info on file. Even if I had used my father's info, it (except the social) would have been wrong because we lived overseas on a military base. When your system says Japan and someone from the US is calling, that should set off all sorts of alarm bells.
  - jib 11y ago
    Swedish social security numbers are public information btw, just to clarify the insanity - I can call in to the government register and ask for anyone's number, there isn't even any obfuscation or semi-privacy about it like US SSNs.
    - scrollaway 11y ago
      there isn't even any obfuscation or semi-privacy about it like US SSNs. GOOD. The US "private" SSN system is completely messed up. You can't commit identity theft by just knowing a personnummer. Very, very much unlike the US...
      - kqr 11y ago
        But you can. People treat the full "personal numbers" as a secret and if you can recite one, nobody will think you're anyone different. It's not meant to be this way, but in my experience it is.
  - yxhuvud 11y ago
    The Swedish personal numbers are not a secret, so that is not a protection in any kind. You can get the number for anyone by asking the tax agency.
  - rasz_pl 11y ago
    reminds me of this story http://www.windytan.com/2015/04/trackers-and-bank-accounts.html http://www.windytan.com/2015/04/trackers-and-bank-accounts.h...
- Someone 11y ago
  If you also can choose your account name, use it as sort-of additional password space. I have accounts with several instances where I could give you my password without running much risk of you logging in; even if their phone support would give out my account name, chances are they or you would misspell the line noise that it looks like.
  - PhantomGremlin 11y ago
    Yes, Schwab does let you choose your account name. I'm not sure how many chars it can have.
- PhantomGremlin 11y ago
  8 characters max Ha. Even better, they're also CASE INSENSITIVE!!! We discussed this here a year ago: https://news.ycombinator.com/item?id=8783790 https://news.ycombinator.com/item?id=8783790
- noahbradley 11y ago
  *Handled They now support 200+ character passwords.
- reddytowns 11y ago
  They fixed that recently. Change your password
- ninov 11y ago
  My bank (German "Sparkasse") only allows passwords with exactly 5 letters or numbers for their online banking. I asked why they're doing this, but didn't get a good response.
  - aurelian15 11y ago
    When I asked, I got the answer that I could chose an arbitrary 16 character long user name, that the password may contain special characters, that the number of allowed failures for logging in is limited and that any actual money transfers are protected by a TAN. So it may not be that bad, given that the PIN for my EC card has only four numbers. Still, I agree that this scheme is somewhat odd and no limitation on the password length would be preferable.
- apozem 11y ago
  One of my neighbors when I was growing up worked in the FBI's cybercrime division. His wife always complained about how he never let her do any of their banking or serious financial transactions online. When I hear stuff like this, I get why.
- bryankaplan 11y ago
  That used to be true, but Schwab has since removed their character limit. I just updated my password to one having more than sixty characters.
- ufmace 11y ago
  Which makes you think - Schwab is keeping probably billions of dollars safe. I've never heard of a theft from them, including via online account compromise. Meanwhile, many other sites doing better jobs of following security best practices can't keep even email addresses secure. Maybe we're the ones doing it wrong, and it's us that should be learning from them?
masklinn 11y ago
There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-practices.html http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the system may also map letters (case-insensitively) to numbers grouped by 3… think your password is "fido"? it's actually encoded as 3436) > Also, during the early days of inline password generators, there were cases where the suggested password was incompatible with the associated system. That still happens to this day. There are still a ton of password forms out there which only accept very short alphanumeric-only passwords. [0] https://upload.wikimedia.org/wikipedia/commons/7/7b/Rotarydial.JPG https://upload.wikimedia.org/wikipedia/commons/7/7b/Rotarydi...
- sly010 11y ago
  > think your password is "fido"? it's actually encoded as 3436) A form of hashing... ⸮
- gambiting 11y ago
  Try to create a password at Jet2.com. A Password like: "SuperSecretPassword!" gives you an error "Your password must be at least six characters or more and is case sensitive.". It's idiotic.
  - masklinn 11y ago
    Oh yes, I'd almost forgotten about the misleading, unhelpful or downright incorrect error messages. It's also fun when account creation and login form don't use the same validation rules, so you can create an account but then you can't log into it.
    - _asummers 11y ago
      Even major sites suffer from this. Netflix web UI allows 60 character passwords, but their Roku app and I believe the Xbox One app only allow 50 character passwords.
jzwinck 11y ago
Solaris, an otherwise good quality enterprise operating system, had an 8-character limit just like that for decades. They only fixed it in the default configuration maybe five years ago. You can read about it here: http://blog.mc-thias.org/?title=solaris-10-password-length-limitation&more=1&c=1&tb=1&pb=1 http://blog.mc-thias.org/?title=solaris-10-password-length-l...
someotheracct7 11y ago
Would love it if there were some kind of markup standard that password managers could read to determine the site's password rules when generating strong passwords. I have the problem now with sites that don't tell you their password policy - I'll try several times to generate a password in LastPass and then end up with several entries for the same site, which I now need to inspect to determine which one is the one I don't want to delete. Hugely annoying.
- tbabb 11y ago
  I would love it if there were FCC-mandated password handling standards, like a (long) minimum max length, a (wide) mimimum permissible charset, and forbidden plaintext storage. It's arguably an issue of national security. (Or some other appropriate regulatory agency).
  - sbierwagen 11y ago
    Jurisdiction over which agency gets to do "cyber" stuff has been an open question for the last thirty years. You can make good arguments that it should be covered by the FBI, NSA, DHS, ATF, the secret service, etc etc. (Yes, the Secret Service! The famous raid on Steve Jackson Games back in 1990 was actually carried out by Secret Service agents, who thought that GURPS Cyberpunk was an actual hacking manual.)
- Cyberdog 11y ago
  There sort of is. In HTML5, text-based form elements have a new "pattern" attribute which takes a regular expression that matches valid input, so the browser can do client-side validation without using JavaScript to intercept the form before it's posted and such. Assuming the site developers have bothered to implement it on their site, then theoretically a password manager could use that to determine valid characters for generated passwords (or, at least, invalid ones). I don't know if any of them actually do this, though. http://www.w3.org/wiki/HTML/Elements/input/password http://www.w3.org/wiki/HTML/Elements/input/password
- mikeash 11y ago
  The thing is, how many sites are going to have developers clued-up enough to incorporate this markup, but not clued-up enough to avoid stupid password policies that break password managers? We only run into trouble because sites incorporate silly requirements like "you must have at least one symbol, even if your password is 48 characters long." Fixing that really seems like the better and more attainable goal.

TwoBit 11y ago

That's how Schwab.com implements passwords. 8 characters max. For life savings brokerage accounts.

INTPenis 11y ago
Swedbank in Sweden have a feature where you can access an accounts entire balance by generating random CC#'s for online shopping and this service is protected by your social security number, a 6 character password, a-z, 0-9 and no special characters allowed. They've had this for at least 6 years now, maybe longer. Early on when I e-mailed them about it they simply stated that it's not their service, in other words; out-sourced.
- emerongi 11y ago
  Swedbank also requires two-factor authentication. You can bypasss this by calling them - they only ask for 1 thing to authenticate you. Two-factor authentication is rather useless if you can just bypass it like that.
  - INTPenis 11y ago
    Yes, and I had no idea they were that easy to bypass on a social level. Also this CC# generator falls outside of the 2FA scope, also something I asked them about several years ago and received the same reply "it's not our service". It's scary.
  - Zach_the_Lizard 11y ago
    >You can bypasss this by calling them - they only ask for 1 thing to authenticate you. The domain for my personal site is shared with my family. My father registered the domain and all of the details in the account use his information. I had just created an AWS account and wanted to move the site's DNS to Route53. I was able to call into the domain registrar and get exactly zero of the details correct, but they pointed the domain to Route53. It was hilarious how bad it was. I used my social, my name, my address, etc., none of which matched the info on file. Even if I had used my father's info, it (except the social) would have been wrong because we lived overseas on a military base. When your system says Japan and someone from the US is calling, that should set off all sorts of alarm bells.
- jib 11y ago
  Swedish social security numbers are public information btw, just to clarify the insanity - I can call in to the government register and ask for anyone's number, there isn't even any obfuscation or semi-privacy about it like US SSNs.
  - scrollaway 11y ago
    there isn't even any obfuscation or semi-privacy about it like US SSNs. GOOD. The US "private" SSN system is completely messed up. You can't commit identity theft by just knowing a personnummer. Very, very much unlike the US...
    - kqr 11y ago
      But you can. People treat the full "personal numbers" as a secret and if you can recite one, nobody will think you're anyone different. It's not meant to be this way, but in my experience it is.
- yxhuvud 11y ago
  The Swedish personal numbers are not a secret, so that is not a protection in any kind. You can get the number for anyone by asking the tax agency.
- rasz_pl 11y ago
  reminds me of this story http://www.windytan.com/2015/04/trackers-and-bank-accounts.html http://www.windytan.com/2015/04/trackers-and-bank-accounts.h...
Someone 11y ago
If you also can choose your account name, use it as sort-of additional password space. I have accounts with several instances where I could give you my password without running much risk of you logging in; even if their phone support would give out my account name, chances are they or you would misspell the line noise that it looks like.
- PhantomGremlin 11y ago
  Yes, Schwab does let you choose your account name. I'm not sure how many chars it can have.
PhantomGremlin 11y ago
8 characters max Ha. Even better, they're also CASE INSENSITIVE!!! We discussed this here a year ago: https://news.ycombinator.com/item?id=8783790 https://news.ycombinator.com/item?id=8783790
noahbradley 11y ago
*Handled They now support 200+ character passwords.
reddytowns 11y ago
They fixed that recently. Change your password
ninov 11y ago
My bank (German "Sparkasse") only allows passwords with exactly 5 letters or numbers for their online banking. I asked why they're doing this, but didn't get a good response.
- aurelian15 11y ago
  When I asked, I got the answer that I could chose an arbitrary 16 character long user name, that the password may contain special characters, that the number of allowed failures for logging in is limited and that any actual money transfers are protected by a TAN. So it may not be that bad, given that the PIN for my EC card has only four numbers. Still, I agree that this scheme is somewhat odd and no limitation on the password length would be preferable.
apozem 11y ago
One of my neighbors when I was growing up worked in the FBI's cybercrime division. His wife always complained about how he never let her do any of their banking or serious financial transactions online. When I hear stuff like this, I get why.
bryankaplan 11y ago
That used to be true, but Schwab has since removed their character limit. I just updated my password to one having more than sixty characters.
ufmace 11y ago
Which makes you think - Schwab is keeping probably billions of dollars safe. I've never heard of a theft from them, including via online account compromise. Meanwhile, many other sites doing better jobs of following security best practices can't keep even email addresses secure. Maybe we're the ones doing it wrong, and it's us that should be learning from them?

masklinn 11y ago

There's a lot of crap out there: http://www.troyhunt.com/2011/01/whos-who-of-bad-password-practices.html http://www.troyhunt.com/2011/01/whos-who-of-bad-password-pra... It's common when there's a web interface bridging directly into a legacy mainframe system built in the 70s. That's how you see things like "your password can't contain Q or Z" (it was originally a rotary phone-dial interface and ancient US phones didn't have Q or Z[0] — to say nothing of special characters, this means the system may also map letters (case-insensitively) to numbers grouped by 3… think your password is "fido"? it's actually encoded as 3436) > Also, during the early days of inline password generators, there were cases where the suggested password was incompatible with the associated system. That still happens to this day. There are still a ton of password forms out there which only accept very short alphanumeric-only passwords. [0] https://upload.wikimedia.org/wikipedia/commons/7/7b/Rotarydial.JPG https://upload.wikimedia.org/wikipedia/commons/7/7b/Rotarydi...

sly010 11y ago
> think your password is "fido"? it's actually encoded as 3436) A form of hashing... ⸮
gambiting 11y ago
Try to create a password at Jet2.com. A Password like: "SuperSecretPassword!" gives you an error "Your password must be at least six characters or more and is case sensitive.". It's idiotic.
- masklinn 11y ago
  Oh yes, I'd almost forgotten about the misleading, unhelpful or downright incorrect error messages. It's also fun when account creation and login form don't use the same validation rules, so you can create an account but then you can't log into it.
  - _asummers 11y ago
    Even major sites suffer from this. Netflix web UI allows 60 character passwords, but their Roku app and I believe the Xbox One app only allow 50 character passwords.

jzwinck 11y ago

Solaris, an otherwise good quality enterprise operating system, had an 8-character limit just like that for decades. They only fixed it in the default configuration maybe five years ago. You can read about it here: http://blog.mc-thias.org/?title=solaris-10-password-length-limitation&more=1&c=1&tb=1&pb=1 http://blog.mc-thias.org/?title=solaris-10-password-length-l...

someotheracct7 11y ago

Would love it if there were some kind of markup standard that password managers could read to determine the site's password rules when generating strong passwords. I have the problem now with sites that don't tell you their password policy - I'll try several times to generate a password in LastPass and then end up with several entries for the same site, which I now need to inspect to determine which one is the one I don't want to delete. Hugely annoying.

tbabb 11y ago
I would love it if there were FCC-mandated password handling standards, like a (long) minimum max length, a (wide) mimimum permissible charset, and forbidden plaintext storage. It's arguably an issue of national security. (Or some other appropriate regulatory agency).
- sbierwagen 11y ago
  Jurisdiction over which agency gets to do "cyber" stuff has been an open question for the last thirty years. You can make good arguments that it should be covered by the FBI, NSA, DHS, ATF, the secret service, etc etc. (Yes, the Secret Service! The famous raid on Steve Jackson Games back in 1990 was actually carried out by Secret Service agents, who thought that GURPS Cyberpunk was an actual hacking manual.)
Cyberdog 11y ago
There sort of is. In HTML5, text-based form elements have a new "pattern" attribute which takes a regular expression that matches valid input, so the browser can do client-side validation without using JavaScript to intercept the form before it's posted and such. Assuming the site developers have bothered to implement it on their site, then theoretically a password manager could use that to determine valid characters for generated passwords (or, at least, invalid ones). I don't know if any of them actually do this, though. http://www.w3.org/wiki/HTML/Elements/input/password http://www.w3.org/wiki/HTML/Elements/input/password
mikeash 11y ago
The thing is, how many sites are going to have developers clued-up enough to incorporate this markup, but not clued-up enough to avoid stupid password policies that break password managers? We only run into trouble because sites incorporate silly requirements like "you must have at least one symbol, even if your password is 48 characters long." Fixing that really seems like the better and more attainable goal.