this post was submitted on 19 Jul 2023
742 points (98.2% liked)
Asklemmy
43856 readers
1784 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is one of the dumbest shit ngl. My bank also does this. However they go one step further. They force a maximum 12 letter password and 1 character of each type (capital, small, number, symbol) is necessary. This actively reduces password security smh
Mine truncated the first 8 characters, when I discovered that I sent them a request to their cyber security department and they told me.of was by design.
I closed my account over that bs
It's because they likely have an ancient backend that can't fit it in the database field...
a legitimate reason to close the account and back away slowly
Wtf lmao. How to I check if mine does it๐
Type the first 8 chars and see if you can still log in?
Good idea, although this wouldnโt tell you if they truncated the password at 9 characters instead (or 10 or 11 characters etc).
So you would have to try different attempts without making too many in one sitting that gets you locked out.
If you tried your password without the last character, then I think that would tell you if ANY truncation is being used (but it wonโt tell you whether it happened at the 8th, 9th, 10th etc character). But that seems like the best thing to try first just to rule it out.
I checked network logs. Apparently my bank encrypts both uid and password before sending. I put 8 chars and it gave error so I'm assuming no
that's exactly how I figured it out. then asked for some friends and family with account in the same bank to validate
My bank also does this shit. It's aggravating to use their website when every step along the way they put the burden of security on the user.
Pasting is disabled on almost every text field, even for things like account numbers (which they make you type in twice) when you want to do a transfer. The only way to log in is to manually type in your username, password, and a damn captcha everytime. The 6 digit 2FA code is the icing on the cake. If you idle for a minute or two, they log you out and force you to go through the whole thing again.
Banks make the worst possible UI and justify it by saying "security" xD
Because people would write down their passwords? I wonder how many people use their browser's built in password manager
That's one way it is weaker, but moreso because it reduces the entropy. If a user can provide a password which uses 26 letters, upper and lowercase, 10 numbers, and an unrestricted set of symbols, but for the sake of argument we'll say 10, then there are a lot of possible combinations. If you are limited to only 12 possible at max, it is 46^12. Now you impose an artificial requirement that it is one of each, then it actually weakens that further by making the hacker know that there is one of each in there so it is 2626101046^8. Or roughly 910^19 vs. 1.3610^18. I personally try to use passwords which are between 16-20 characters long, or roughly 2*10^33. By restricting the total number of characters and forcing specific combinations, then the password is less cryptographically sound.
Using this calculator, https://bitwarden.com/password-strength/, it is a difference of 3 hours vs. centuries using the bank's mandate vs. only lowercase and 20 characters.
Edit: Something seemed off about the math. Should have multiplied instead of added, but still less sound secure because there are imposed requirements. The biggest issue is that there is an upper limit of 12 characters.
The 20 character requirement is kind of a huge component though.
Sure. Banks should be enforcing that instead of special characters. But the vast majority of people would just choose "football" or "password" as their passwords if they weren't required to do something more complex.
I disagree with the argument that it's less secure to require symbols in passwords as a blanket statement . It's less secure to require symbols in passwords than if you are also enforcing much longer minimum passwords as well.
Ironically though, something like
as a password would be miles ahead of even the most random character combination possible, but which is only 12-20 characters long.
And as an added bonus, the above example is practically guaranteed to have never been used before, in addition to being correct horse battery staple (that is, tremendously easy to remember).
I hate when a website/app in this day and age imposes an absurdly low upper password character limit like 30. (cough looking at you, PayPal, when I re-set my password a few years ago it was freaking 20, not exaggerating).
Shouldn't password length below like 100 (or realistically, any length until it starts crashing the js behind it?) not matter anyways, since it's all salted, peppered and hashed before further processing anyways?
There is no technical reason for there to be a maximum length on the user's password.
Watch:
Here's a password bitwarden generated for me:
Bonded-Reforest-Prenatal7-Spoken-Straggler-Catcall
Here's the base64-encoded SHA3-512 hash for that password:
Q2WaVLdTAg5T4xi3VB5PMI7GkAv3np9Usa2+uTMglbMcDDAdYXzUNgAzzYLoSWku/e007vkKfvSotzoriSKt4Q==Here's the has for the password
password:6adUhnNqVQr0/qhh4jeDBcSlVaBQlN7h3KL2iv6knMOlDo3m6hMepSExH01vsFShRugoL441/y5jaMGmLpCXFg==Notice how the thing the website should be storing in their database is exactly the same length, regardless of the input?
For extra fun, here's the hash for your sample password:
GbxnrQ31PInMSu2ik2ZR5TefgXIInSJBxZ5zwcYmkRxzw07tZoxPqJbEmcbuTBpzCZzwLrqqcxz04p8ToGszRQ==Here's a tool to generate your own hashes: https://www.liavaag.org/English/SHA-Generator/
I mean, if we're being pedantic, there's a reasonable technical limit once the password reaches multiple MBs of data.
But yes, there's no good reason for the actual limits we're seeing out in the wild.
Yes @evatronic, this is of course what I meant with โexcept if the js starts crashing maybeโ. Iโm aware that hashes end up with the same length, no worries ๐
Yeah, I agree they should be requiring much longer minimum password lengths (and show users how to use passphrases). Max password lengths are also absurd.