-1

I am aware of a bank (redacted for obvious reasons) that has the following password policy.

  1. Only English alphanumeric characters
  2. Min of 8, max of 14 characters
  3. No special characters (ex. !@#$%^&* are all forbidden)
  4. Passwords must be changed every year
  5. Account lockout after 4 bad attempts

What are the specific problems with this policy and how would a would-be bad-actor theoretically attack such a target?

I already sent them a comment arguing that their policy is terrible, especially the 14 char limit (if they use bCrypt they can use up to 72 bytes, IIRC) and the fact that they only allow English alphanumerics instead of any ASCII/Unicode char, hoping they will change their policy to embrace more standard rules.

7
1

Rule 1 is typical for character set interoperability - Unicode characters may be encoded in UTF-8, Latin-1, or any other unspecified encoding.

The minimum value for rule 2 is obviously for providing minimum password strength, whereas the maximum is to ensure server processing speed (OWASP recommends 64 as a maximum, specific applications may have additional limits due to historical reasons).

Rule 3 is unwarranted. My wild guess would be that their server is still using string concatenation for constructing database queries, or that their mobile app has special keyboard that just doesn't support special characters.

Rule 4 is close to reasonable, but not fully.

A reasonable person would deem rule 5 necessary with the maximum 14 character limit.

5
  • 2
    Server processing speed concerns for passwords over 14 chars? I mean, we're living in 2021. How slow are their servers that they can't afford to hash a few measly bytes more? Jul 21 at 10:39
  • Rule 4 is absolute trash. If I know your username, I can lock your account forever.
    – MechMK1
    Jul 21 at 14:40
  • @MechMK1 Do you mean Rule 5? Jul 21 at 17:50
  • @IStandWithIsrael you assume they are using a modern computer with a modern programming language and libraries. Many banks still run 30-year-old proprietary servers.
    – schroeder
    Jul 21 at 20:11
  • @FireQuacker Yes, my bad.
    – MechMK1
    Jul 22 at 11:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.