My bank (it's Westpac, one of the big ones in Australia) has some strange restrictions on passwords. They're maximum 6 characters in length and it must contain only characters A-Z and digits 0-9, and there's no case sensitivity.

I'm used to using much longer passwords or even passphrases for other online accounts, and it seems like the bank password strength is relatively weak. On the other hand, the password to my finance seems like one that should be much more important than other things such as forum logins, ebay account etc ...

So why does a major bank not let you choose a stronger password? Should I be concerned about their security?

  • 1
    Do they use other authentication factors as well, such as OTP codes, challenges, etc? – Henning Klevjer Oct 18 '12 at 5:20
  • no, just customer number and password. if i make a large transaction, they send an SMS to my mobile phone where i must enter a 4 digit number to confirm the transaction. – wim Oct 18 '12 at 5:22
  • 3
    I would consider using another bank; I have to wonder if this is the way they treat passwords, what does the rest of their security implementation look like? – Mark C. Wallace Oct 18 '12 at 12:16
  • @MarkC.Wallace By reading their security pages I got the feeling that they're paying their customers back their stolen money instead of security. Interesting choice for a bank. – Henning Klevjer Oct 18 '12 at 12:18
  • I think password entropy isn't that important for security unless it's really bad. Trojans are a much bigger threat than online brute-force attacks. Just like you're using 4 digit pins. – CodesInChaos Oct 18 '12 at 13:17

This means they are almost definately storing passwords in plaintext in a 6-character database field. If they were only storing a (salted) hash - as they should - then they wouldn't care about the password length since the hash function would produce a value of a fixed size regardless of the length of the input (password).

Your bank is probably still using systems from the 70s (or from before the industry standardised on salted hashing) and they don't take password security seriously enough to sort this out. This is the case with a lot of banks. You should start by complaining.

  • 1
    Call them and say you've lost your password for your online account and see if they can tell you what it is. That'll let you know if they're storing it in cleartext. Either way, though, I would move to a different bank. Even if they are encrypted, if someone where to hack in and get a copy of their User database, it would literally take only 1-2 seconds with a gpu cracker to crack all the passwords, making your user account accessible to the attacker. He could then transfer all of the money out of your account. – Safado Oct 18 '12 at 15:51
  • But that is still a big if. If someone had a copy of their user database I would assume the bank already has bigger problems than password security. – Josh Oct 18 '12 at 16:17
  • I would say this has real practical implications for users only if they are also handling online authentication badly. i.e. what happens if someone tries to enter you account with the wrong password 10 times? Does the account lock? Does a flag go up? Or can someone just keep trying until the can crack these incredibly week passwords? Two suggestions: * Definately go for the 2-factor authentication if it's an option. * Make the most of your 6 digits: choose a completely random password using a generator (don't try to be clever with a dictionary word) – Josh Oct 18 '12 at 16:21
  • 1
    Ok... what about a rogue employee with access to the database? Or if they have offsite tape archiving and a tape gets lost or stolen in transit? Or, heaven forbid, a human error occurs? In this business, it only takes one "big if" to be completely screwed. – Safado Oct 18 '12 at 17:16
  • 1
    defin i tely, (The Oatmeal) – Null Oct 18 '12 at 21:14

If it isn't even illegal (seeing that the six character password is the only authentication mechanism), it sure is concerning. This low level of security in a bank surprises me!

I've taken a look at their security pages where they tell you that they'll pay if your account is comprimised. Anyway, if that bank lost their user credentials, I guess every password would be cracked in minutes. An alphabet of 36 letters is just horrendous.

I see that they've got SecurID tokens for their customers for free. I'd get one immediately.

  • 1
    When a service puts such restrictions on passwords, it raises serious alarms as to whether they're hashing/encrypting the passwords at all... – OtisBoxcar Oct 18 '12 at 10:12
  • Well, if it's case insensitive, either they are storing it plain text, or they are lowercasing it prior to hashing. So I doubt they are really hashing at all... Prob storing plain text and doing a LIKE check in SQL... – ircmaxell Oct 18 '12 at 10:16
  • 3
    With these restrictions it doesn't matter if they hash or not. – CodesInChaos Oct 18 '12 at 13:15

As others have indicated, it's suggestive of security measures that are not up to modern day standards. However, a risk assessment seems to indicate that the risk of financial harm to individual customers is low (if not zero). This is because the bank has indicated (per Henning Klevjer) that customers will not lose money in the event of a compromise.

Can the bank meet such a commitment? Almost certainly. In the event of a widespread compromise, they would have the clout to reverse any illegitimate wire transfers, and would notice if large sums of cash were being withdrawn (and the nice thing about fiat money is that you can always print more! :D )

So while you should still practice good security as much as possible (i.e. Use all character types that you can, don't reuse passwords, make it random), it appears that your actual risk of loss in this case is low.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.