Skip to main content
Information Security

Return to Answer

fix typo
Source Link
Matthew
Matthew
  • 27.4k
  • 7
  • 92
  • 104

Well most people posting here are security concerned and mostly use strong passwords for this reason.

But the bank has another concern: Users who use "123456" as password and feel safe.

For example my own bank forced me to use a character password. Why? Because they want to encourage users to choose strong passwords with high-entropy as they are an option with passwords this short. Because nearly everyone can remember a 5 character random sequence. (BTW, usage of your banking card is still mandatory to make transactions, so 2FA is there)

I'd guess that your bank has discovered the same idea. They want to encourage users in choosing strong paswordspasswords and hence this new policy. This is bad for users with good passwords, but I'd say (got no real stats :( ) that only a few percent of the users use complex, inattackable passwords by default.

Now to judge the policy: I think, for the majority of the users this is good as they are encouraged to use stronger password and only a minority has to suffer (ironically, people who care about security). For the rest you may propose the bank to offer some (hidden) way to get a stronger password allowed, maybe by forcing the users to contact the support to allow a different policy.

Well most people posting here are security concerned and mostly use strong passwords for this reason.

But the bank has another concern: Users who use "123456" as password and feel safe.

For example my own bank forced me to use a character password. Why? Because they want to encourage users to choose strong passwords with high-entropy as they are an option with passwords this short. Because nearly everyone can remember a 5 character random sequence. (BTW, usage of your banking card is still mandatory to make transactions, so 2FA is there)

I'd guess that your bank has discovered the same idea. They want to encourage users in choosing strong paswords and hence this new policy. This is bad for users with good passwords, but I'd say (got no real stats :( ) that only a few percent of the users use complex, inattackable passwords by default.

Now to judge the policy: I think, for the majority of the users this is good as they are encouraged to use stronger password and only a minority has to suffer (ironically, people who care about security). For the rest you may propose the bank to offer some (hidden) way to get a stronger password allowed, maybe by forcing the users to contact the support to allow a different policy.

Well most people posting here are security concerned and mostly use strong passwords for this reason.

But the bank has another concern: Users who use "123456" as password and feel safe.

For example my own bank forced me to use a character password. Why? Because they want to encourage users to choose strong passwords with high-entropy as they are an option with passwords this short. Because nearly everyone can remember a 5 character random sequence. (BTW, usage of your banking card is still mandatory to make transactions, so 2FA is there)

I'd guess that your bank has discovered the same idea. They want to encourage users in choosing strong passwords and hence this new policy. This is bad for users with good passwords, but I'd say (got no real stats :( ) that only a few percent of the users use complex, inattackable passwords by default.

Now to judge the policy: I think, for the majority of the users this is good as they are encouraged to use stronger password and only a minority has to suffer (ironically, people who care about security). For the rest you may propose the bank to offer some (hidden) way to get a stronger password allowed, maybe by forcing the users to contact the support to allow a different policy.

Source Link
SEJPM
SEJPM
  • 9.8k
  • 6
  • 40
  • 69

Well most people posting here are security concerned and mostly use strong passwords for this reason.

But the bank has another concern: Users who use "123456" as password and feel safe.

For example my own bank forced me to use a character password. Why? Because they want to encourage users to choose strong passwords with high-entropy as they are an option with passwords this short. Because nearly everyone can remember a 5 character random sequence. (BTW, usage of your banking card is still mandatory to make transactions, so 2FA is there)

I'd guess that your bank has discovered the same idea. They want to encourage users in choosing strong paswords and hence this new policy. This is bad for users with good passwords, but I'd say (got no real stats :( ) that only a few percent of the users use complex, inattackable passwords by default.

Now to judge the policy: I think, for the majority of the users this is good as they are encouraged to use stronger password and only a minority has to suffer (ironically, people who care about security). For the rest you may propose the bank to offer some (hidden) way to get a stronger password allowed, maybe by forcing the users to contact the support to allow a different policy.