How would it be possible that if my password was 123abc that my bank also accepts something like 123abc12?

Isn't that an extreme security flaw? If the password was hashed and salted, wouldn't the latter create a completely different digest?


This does not mean that your bank is storing your passwords in a plaintext format. The bank could simply be truncating the input password to a certain length before hashing it.

It is a security flaw as there is no good reason to artificially limit the length of passwords, but it might not be as bad storing passwords in plaintext. I would write to them and demand an explanation of why they are doing this.

  • Yeah you are right. My password is exactly 16 characters long, everything entered after that would be truncated I guess. – the_critic Jan 2 '14 at 15:50
  • Financial systems often have mainframes in the backend, and mainframes often have password length limitations which chain outward to customer-facing systems. – gowenfawr Jan 2 '14 at 16:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.