12

I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons".

The policy for new passwords is: 6 to 10 characters, no special characters, no repeated characters, not case-sensitive.

My old password was much better than this. I used a random password generator.

I am not a security expert but this seems like a lax policy. Am I being overly paranoid? This is a business account.

Should I suspect that I myself was hacked?

Note: The ATM card number is not part of the bank's online authentication process.

Note2: I went to Password Meter and was able to cobble together some passwords that meet this criteria and that Password Meter deemed "Very strong". Am I wrong to still be concerned?

Improve this question
9
  • 1
    Does your bank add another authentication method with this password? for example 2-step authentication or something?
    – Ali
    Commented May 10, 2015 at 8:10
  • 3
    As far as password policy goes, this is terrible indeed. Does not matter if 2FA is available or not, this is unacceptable and you should voice your concerns with the bank itself.
    – Pavin Joseph
    Commented May 10, 2015 at 8:18
  • @Joseph, if there are another authentication methods that have been attached to this password policy,such as 2FA, it is not terrible at all, for example why 4 pin digit number for a credit card is OK? because there are other methods for preventing misuse cases.
    – Ali
    Commented May 10, 2015 at 8:39
  • @Ali. The bank does also require use of a token generator (please excuse if this is wrong terminology). But before this policy change I was protected by the token generator plus a long, well-nigh unguessable password. Now I am pretty much relying on the token generator. I definitely feel like they have reduced my security. Re 4-digit PINs, the credit card companies have mitigations that work for them. But it is a major hassle for the user. I'd much rather enter a much longer PIN and not have to deal with Visa's fraud department.
    – Link Green
    Commented May 10, 2015 at 8:48
  • 1
    @LinkGreen te passwordmeter site doesn't even explain how it calculates password strength, and it accepts very weak passwords such as P@ssword1 as "Strong". Use telepathwords.research.microsoft.com instead.
    – Steve Dodier-Lazaro
    Commented May 21, 2015 at 21:35

4 Answers 4

Reset to default
2

This is bad password policy by most standards, but here is the oldest issue (or excuse) in the book (at least for Canadian banks):

Security vs Convenience

The banks do not see the lost a important as user convenience. The fact is that they are not losing enough money due to hacking (at least yet) to consider hindering the user experience.

http://www.theglobeandmail.com/technology/digital-culture/why-canadas-banks-have-weaker-passwords-than-twitter-or-google/article18325257/

The 2 factor authentication may mitigate this a bit, but not very much.

*@Joseph is right, you should complain as the more people complain and expose this, the more they may do something about it. What I don't get is why they do not offer it without forcing anyone, so at least it is there if you wish. I mean not even Cap sensitive... common.

Improve this answer
9
  • why do you say that 2FA would not mitigate very much?
    – schroeder ♦
    Commented Jul 2, 2015 at 18:05
  • @schroeder 2FA does mitigate, don't get me wrong, but in the banks' case, they will use (most of time) pre-constructed security questions as the 2 factor such as "Your mother's maiden name", etc. If the attacker does a bit of phishing first, he/she will then be able to answer that question. The banks do not always use true 2factor auth. For example above, it is still another "Something you know" Some have started to use "Something you have" such as the device, but again if they are doing it with the IP, it is easily defeat-able. It would definitely be a case by case (Particular Bank)
    – rhymsy
    Commented Jul 2, 2015 at 18:11
  • 1
    That's not what 2FA means.
    – schroeder ♦
    Commented Jul 2, 2015 at 18:27
  • 1
    You do not know what 2FA means. You own links explain it to you. The second factor is never something that you know. That's only one factor.
    – schroeder ♦
    Commented Jul 2, 2015 at 20:50
  • 1
    "2FA requires not only a password and username but also something that only, and only, that user has on them, i.e. a piece of information only they should know" - knowledge is only one factor. 2FA, where the second factor is actually a second factor (has/is), does effectively mitigate poor password problems. If you meant to say that pseudo-2FA does not mitigate, then you should say that.
    – schroeder ♦
    Commented Jul 2, 2015 at 22:26
1

Yes it is a bad password policy, but it is mitigated by:

  • second factor authentication
  • strong account lockout features
  • your knowledge that it is a bad policy

Do not compare it against policies meant to withstand offline cracking: if you fear offline password cracking at your bank, you may as well fear direct password sniffing.

Improve this answer
0

Your bank may be using a product like RSA's Adaptive Authentication. It uses multiple attributes to assess behavior (e.g. IP address, time of login, device fingerprint, etc.) to ensure the login is ok. It may even be tied back end to a real human being doing analysis of anomolies, or even tied to a 3rd-party like Equifax.

My bank allows me to have a dinky password and I am not happy about that but I also know they at least have the RSA software in the background adding additional checks.

Improve this answer
0

Well most people posting here are security concerned and mostly use strong passwords for this reason.

But the bank has another concern: Users who use "123456" as password and feel safe.

For example my own bank forced me to use a character password. Why? Because they want to encourage users to choose strong passwords with high-entropy as they are an option with passwords this short. Because nearly everyone can remember a 5 character random sequence. (BTW, usage of your banking card is still mandatory to make transactions, so 2FA is there)

I'd guess that your bank has discovered the same idea. They want to encourage users in choosing strong passwords and hence this new policy. This is bad for users with good passwords, but I'd say (got no real stats :( ) that only a few percent of the users use complex, inattackable passwords by default.

Now to judge the policy: I think, for the majority of the users this is good as they are encouraged to use stronger password and only a minority has to suffer (ironically, people who care about security). For the rest you may propose the bank to offer some (hidden) way to get a stronger password allowed, maybe by forcing the users to contact the support to allow a different policy.

Improve this answer
6
  • 1
    I'm not sure I buy this. Do you have any stats or references for your guess?
    – Neil Smithline
    Commented May 10, 2015 at 14:53
  • 2
    @SOJPM. All of the benefits that you describe are available by having a policy on MINIMUM password complexity. I understand why a floor is necessary. I don't understand why a ceiling is necessary. Considering the high value of what is being protected, this ceiling seems too low.
    – Link Green
    Commented May 10, 2015 at 15:46
  • @NeilSmithline a quick research brought up this research. Another point is this where it's stated that 90% of the (6.5 million)LinkedIn passwords could be retrieved within six days by a private (!) person.
    – SEJPM
    Commented May 10, 2015 at 19:04
  • @LinkGreen I think the idea behind the ceiling is that a higher ceiling would tempt the users to choose weaker passwords (consisting of actual words!) and hence weakening passwords to dictionnary attacks. So something like "Thisisasupersecretpassword" is actually a bad password and forbidden by the upper bound of 10 chars. And it is possible to adequately construct passwords only with characters, as you got 52 at your disposal and if combining ten of them, results in 57 bits of entropy which is unbreakable for bad-funded attackers only having EC2 at max.
    – SEJPM
    Commented May 10, 2015 at 19:09
  • @SOJPM. First of all, thanks for your responses. I doubt that many users who would choose a bad long password would choose a good short password if restricted to 10 characters. Secondly, the exclusion of special characters is not helping them. My bank does not provide the user a way of assessing the strength of the password as some sites do. My guess is that this compromise is a weakness in the banking application and not an attempt to counterintuitively increase security.
    – Link Green
    Commented May 12, 2015 at 5:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .