It's insane that my personal blog is more secure than my bank.
Something was left open and exposed in the central infrastructure for this to happen, or some kind of supply-chain exploit, or a key administrator account credential was phished.
Regardless, I believe my point still stands. I want better options for security; I shouldn't need a better reason than it's where I keep all my money.
(Or at least, a better option should be required to be available.)
The 6 characters designed to be mapped to 6 numbers for a telephone banking PIN.
So aA-cC would all be treated the same (and be a 0 for telephone banking), dD-fF would be 1, etc.
So in reality; there were only a million different passwords.
I thought this stopped ~10 years ago. Or did it?
The communication about the change, and the way the old system worked (without warning nor notification) left a lot to be desired.
Not that it would help in this specific case I guess.
I wonder that with one of my banks, the password is case insensitive. Of course they could lower case it before the hashing but I suspect they don't.
Yikes, that’s scary. Legitimately would make me think about leaving that bank
It's insane to imagine that that is true. :)
Seriously though, if banks and their customers were being defrauded by superficially poor password/MFA hygiene, obviously they would fix that. They are not.