Not only does the credit bureau max out their password length, you have a small list of available non-alphanumeric characters you can use, and no spaces. Also you cannot used a plused email address, and it had an issue with my self hosted email alias, forcing me to use my gmail address.
Both Experian and transunion had no password length limitations, nor did they require my username be my email address.
Update: I have been unable to log into my account for the last 3 days now. Every time I try I get a page saying to call customer service. After a total of 2 hours on hold I finally found the issue, you cannot connect to Equifax using a VPN. In addition there is no option for 2FA (not even email or sms) and they will hang up on you if you push the issue of their security being lax. Their reasoning for lax security and no vpn usage is “well all of our other customers are okay with this”.
Open a bug report
A 20 character password of case insensitive letters and numbers is quite unbreakable (taking billions of years to brute force). Still, what a strange way to announce your database is old and you probably aren’t hashing your password with anything stronger than MD5. Or worse.
My default is to generate a 32 character password and store it in a password manager. Doesn’t matter to me how many characters it has since I’m just going to copy and paste it anyway.
Pretty surprising how many places enforce shorter passwords though… I had a bank that had a maximum character limit of 12. I don’t bank with them anymore. Short password limits is definitely is an indicator of bad underlying security practices.
A hash has a fixed length, including MD5. There’s no reason to cap password (input) Iength. You can hash the whole bible and still get the same length hash. So either they don’t even hash it, they’re idiots, or they try to be unnecessarily cautious to avoid some other limit / overflow, like POST max size (which would still be counted in at least KB, not several characters). The limit on what special characters you can use is also highly suspicious - that’s not how you deal with injections / escaping your inputs.
Hashing takes longer the longer the string is, so it technically could impact performance if many people with very long passwords log in simultaneously. 20 characters is ridiculous though, you could probably cap it at hundreds and still be completely fine.
short passwords because they are trying to save bandwidth for their next time their entire database structure is downloaded
They’re supposed to be hashed so that shouldn’t matter
Unless that’s the joke or something
I went through that bullshit so many times trying to get the characters etc then the next step said not available try again later…
I always get a chuckle when financial institutions have requirements like these, or lack 2FA. My Lemmy account has more security at this point.
Literally this
Except todays wordle answer cannot be made to multiply to 35
I got to rule #16 - I suck at chess. Secret to “multiply roman numerals” is just add them up to the value.
I have seen this on a site before and I never understood why. Whats the point of limiting the length of the password? Its not to save storage space since the plain text isnt stored and the hash should be a uniform length. So whats the advantage?
Calculating hashes is supposedly more expensive for longer strings. That could be used to simplify some kind of overload attack like DDOS.
If they’re not already rate-limiting login attempts that’s another huge problem…
If they’re using md5 (which would be in line with their security practices), the block size is 512 bits. That means that everything less than 64 characters is the same cost
since the plain text isnt stored
I’m not sure I’d accept a bet on that assumption.
deleted by creator
Imagine having to contract with a company in order for them not to fuck your life up with your own data. This is ridiculous.
You signed a contract? Pretty sure they’re going to fuck it up either way and they definitely have all your data.
that they collect without your explicit consent
Super long passwords aren’t going to do you any good when their database is compromised and sold to anyone with a few bucks.
Its not like some one is gonna be brute forcing your account password, it would lock your account after like ten tries.
Quite the contrary.
Password hashing is standard nowadays.
When a database is compromised, brute forcing hashes is necessary to recover passwords, and the short ones are the first ones to be recovered.
So what? They’ll get your single use randomly generated password months/years/decades after you’ve already changed it?
Which begs the question, how often do people really change their passwords unless they’re forced to? This feels like the sort of thing that somebody should have studied.
If its not been pwned then why bother? As long as you’re using a password generator and only using per a service passwords plus MFA youll be fine
Just wait until you get to Transunion’s site. It is a dumpster fire of consisting of the worst sign up I’ve ever seen, “Contact our social team” and "If you haven’t logged in for awhile create a new account. I could not believe how awful it was. I had to just call and do it over the phone.
Transunion was not too bad, and they did not require my full SSN, unlike Equifax. But transunion will not easily give me my credit score unlike the two Es.
I had an account there with a proton email address and suddenly I couldn’t log in anymore. After 6 months of calling, someone finally told me proton emails are blocked because they are not secure. So I changes it to a tutanota email
What a clusterf**k
I almost used my proton mail because I can create an alias, where equifax would not accept a plused gmail account.
Removed by mod
I use a 5 word phrase generated by my password locker. I will add a symbol or three to it if required.
I recommend Diceware for generating memorable passwords of sufficient complexity…but also, a password manager.
And I use password manager, I don’t care of its 52 chars long, I just use the software to fill the field
Removed by mod
that is a painfully bad list of
requirementsbullshit@nokturne213 In Canada, we also have transunion; they officially say max pw size is 30 but it’s actually 15. Complete joke. At least Equifax has proper 2FA.
I tried to log in to see if I could activate 2FA and it says I have to call customer service to log in now.
Don’t worry this is easily solved by sending a fax of your drivers license Mo-Fr between the hours of 8:05am and 8:09am
Financial institution security is quite frankly a freaking joke. My bank only has the options for 11 character passwords at maximum. It’s like oh come on that is way too easy these days
Honestly, that’s a sign to me that your bank doesn’t take cybersecurity seriously and would possibly consider switching. Mine has amazing security as well as fraud detection. Sometimes it’ll even send me a text to verify a purchase if their software thinks it’s weird I got across town too quickly, though that’s pretty rare so it isn’t overly aggressive/inconvenient.
In Germany at least, I hear that banks have weird law requirements for these weird security things, like photoTAN.
I’d be much happier if they’d just let me do my usual setup with password, totp and my hardware token.
In the US the FDIC sets security requirements for banks and audits annually, and they keeps raising requirements every year or so. At this point its just easier for a bank to invest in following current best practices and keep updating to the current best practices than to keep chasing every new finding on the FDIC audits each year
Source: I worked in IT at a bank for a while
Oh but wait! That non-customizable
account numberuser ID that you have to wait for in the mail is definitely top notch security!
