Hacker News Reader

Comment by BrandoElFollito | Hacker News Reader

My bank requires a password of exactly 8 digits. In 2023.

I know of banks which, in 2023, requires exactly 8 digits, the first four being numbers, the other four later letters. No digit can be repeated. Also no consecutive numbers.

It's like they're deliberately trying to reduce the pool of valid inputs.

Not only this, but they also have a sadistic trait against their users. My password on another site (a bank too, IIRC) requires the password not to have my email username and consecutive, or repeated letters. My email username is "u" (as is u@example.com) and I usually generate a 50 or 70 characters long password. There is usually a "u" (they check the case, too). And come characters are repeated in the whole password.

So I reduce the length, significantly, sometimes to 8 characters.

The people who make rules in security in some areas are complete idiots.

A bank I used until about 2018 (no idea if they've fixed this yet - I left) had an exactly 6 character password, and when you used telephone banking it just needed the 6 digits that corresponded to that word. Those 6 numbers also worked online, so at best they were turning all passwords into numbers before hashing them, ensuring there are less than 900000 different possible passwords, which was trivially easy to brute force in 2015, nevermind today.

Bruteforcing should not work as the attempts are either throttled, or lock the account. Provided that they are in place, otherwise the account is wide open.

This i what happens with the 4 digits of a CC PIN and the 3 attempts before the card switches into PUK mode.

Reply on news.ycombinator.com