9

My bank (it's Westpac, one of the big ones in Australia) has some strange restrictions on passwords. They're maximum 6 characters in length and it must contain only characters A-Z and digits 0-9, and there's no case sensitivity.

I'm used to using much longer passwords or even passphrases for other online accounts, and it seems like the bank password strength is relatively weak. On the other hand, the password to my finance seems like one that should be much more important than other things such as forum logins, ebay account etc ...

So why does a major bank not let you choose a stronger password? Should I be concerned about their security?

Improve this question
7
  • 1
    Do they use other authentication factors as well, such as OTP codes, challenges, etc?
    – Henning Klevjer
    Oct 18, 2012 at 5:20
  • no, just customer number and password. if i make a large transaction, they send an SMS to my mobile phone where i must enter a 4 digit number to confirm the transaction.
    – wim
    Oct 18, 2012 at 5:22
  • 4
    I would consider using another bank; I have to wonder if this is the way they treat passwords, what does the rest of their security implementation look like?
    – MCW
    Oct 18, 2012 at 12:16
  • @MarkC.Wallace By reading their security pages I got the feeling that they're paying their customers back their stolen money instead of security. Interesting choice for a bank.
    – Henning Klevjer
    Oct 18, 2012 at 12:18
  • I think password entropy isn't that important for security unless it's really bad. Trojans are a much bigger threat than online brute-force attacks. Just like you're using 4 digit pins.
    – CodesInChaos
    Oct 18, 2012 at 13:17

3 Answers 3

Reset to default
17

This means they are almost definately storing passwords in plaintext in a 6-character database field. If they were only storing a (salted) hash - as they should - then they wouldn't care about the password length since the hash function would produce a value of a fixed size regardless of the length of the input (password).

Your bank is probably still using systems from the 70s (or from before the industry standardised on salted hashing) and they don't take password security seriously enough to sort this out. This is the case with a lot of banks. You should start by complaining.

Improve this answer
7
  • 1
    Call them and say you've lost your password for your online account and see if they can tell you what it is. That'll let you know if they're storing it in cleartext. Either way, though, I would move to a different bank. Even if they are encrypted, if someone where to hack in and get a copy of their User database, it would literally take only 1-2 seconds with a gpu cracker to crack all the passwords, making your user account accessible to the attacker. He could then transfer all of the money out of your account.
    – Safado
    Oct 18, 2012 at 15:51
  • But that is still a big if. If someone had a copy of their user database I would assume the bank already has bigger problems than password security.
    – Josh
    Oct 18, 2012 at 16:17
  • 1
    I would say this has real practical implications for users only if they are also handling online authentication badly. i.e. what happens if someone tries to enter you account with the wrong password 10 times? Does the account lock? Does a flag go up? Or can someone just keep trying until the can crack these incredibly week passwords? Two suggestions: * Definately go for the 2-factor authentication if it's an option. * Make the most of your 6 digits: choose a completely random password using a generator (don't try to be clever with a dictionary word)
    – Josh
    Oct 18, 2012 at 16:21
  • 1
    Ok... what about a rogue employee with access to the database? Or if they have offsite tape archiving and a tape gets lost or stolen in transit? Or, heaven forbid, a human error occurs? In this business, it only takes one "big if" to be completely screwed.
    – Safado
    Oct 18, 2012 at 17:16
  • 1
    defin i tely, (The Oatmeal)
    – Null
    Oct 18, 2012 at 21:14
5

If it isn't even illegal (seeing that the six character password is the only authentication mechanism), it sure is concerning. This low level of security in a bank surprises me!

I've taken a look at their security pages where they tell you that they'll pay if your account is comprimised. Anyway, if that bank lost their user credentials, I guess every password would be cracked in minutes. An alphabet of 36 letters is just horrendous.

I see that they've got SecurID tokens for their customers for free. I'd get one immediately.

Improve this answer
3
  • 1
    When a service puts such restrictions on passwords, it raises serious alarms as to whether they're hashing/encrypting the passwords at all...
    – OtisBoxcar
    Oct 18, 2012 at 10:12
  • Well, if it's case insensitive, either they are storing it plain text, or they are lowercasing it prior to hashing. So I doubt they are really hashing at all... Prob storing plain text and doing a LIKE check in SQL...
    – ircmaxell
    Oct 18, 2012 at 10:16
  • 4
    With these restrictions it doesn't matter if they hash or not.
    – CodesInChaos
    Oct 18, 2012 at 13:15
3

As others have indicated, it's suggestive of security measures that are not up to modern day standards. However, a risk assessment seems to indicate that the risk of financial harm to individual customers is low (if not zero). This is because the bank has indicated (per Henning Klevjer) that customers will not lose money in the event of a compromise.

Can the bank meet such a commitment? Almost certainly. In the event of a widespread compromise, they would have the clout to reverse any illegitimate wire transfers, and would notice if large sums of cash were being withdrawn (and the nice thing about fiat money is that you can always print more! :D )

So while you should still practice good security as much as possible (i.e. Use all character types that you can, don't reuse passwords, make it random), it appears that your actual risk of loss in this case is low.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .