I am aware of a bank (redacted for obvious reasons) that has the following password policy.
- Only English alphanumeric characters
- Min of 8, max of 14 characters
- No special characters (ex. !@#$%^&* are all forbidden)
- Passwords must be changed every year
- Account lockout after 4 bad attempts
What are the specific problems with this policy and how would a would-be bad-actor theoretically attack such a target?
I already sent them a comment arguing that their policy is terrible, especially the 14 char limit (if they use bCrypt they can use up to 72 bytes, IIRC) and the fact that they only allow English alphanumerics instead of any ASCII/Unicode char, hoping they will change their policy to embrace more standard rules.