I just received an email from my credit union saying they are redesigning their online banking service and that I will need to change my password by October 22 to conform to the new limit of 10 characters. The current limit is 20 characters.
This reduces the maximum password entropy from 125 to 54 bits (according to KeePass), compromising the security of passwords. More importantly, though, I fear that this is evidence the web architects behind this redesign are clueless about security.
- Am I getting worked up over nothing? Is 10 characters actually enough even if you are limited to letters and numbers?
- If not, are there any regulations specifying or recommending a maximum password length for online banking services?
- Can you recommend a reference on website security best practices I can send my credit union to bolster my case that 10 characters is inadequate?
I contacted my credit union today (a Saturday) about their security practices, and someone actually responded to the email same day. Judging from the replies, it sounds like they have offsite vendors that handle passwords, the security question system, and the like, and passwords are encrypted and never stored as plain text. Also, they are now allowing passwords to contain symbols rather than just letters/numbers, so that slightly improves the maximum strength of a password over what I thought (though it's still a reduction from the original requirements). So, while I'm not entirely convinced that site security is optimal, it doesn't sound like a complete disaster. Thanks for all the advice and feedback.