Not only does the credit bureau max out their password length, you have a small list of available non-alphanumeric characters you can use, and no spaces. Also you cannot used a plused email address, and it had an issue with my self hosted email alias, forcing me to use my gmail address.
Both Experian and transunion had no password length limitations, nor did they require my username be my email address.
Update: I have been unable to log into my account for the last 3 days now. Every time I try I get a page saying to call customer service. After a total of 2 hours on hold I finally found the issue, you cannot connect to Equifax using a VPN. In addition there is no option for 2FA (not even email or sms) and they will hang up on you if you push the issue of their security being lax. Their reasoning for lax security and no vpn usage is “well all of our other customers are okay with this”.
Yeah well, if you’re so smart let’s see you write a website in COBOL.
no spaces in a string is a dead giveaway that theres Cobol in there somewhere meow
meow
?
their name is kittykittycatboys what else do you expect :3 meow
It shows up on my screen as merely “max”, nothing else.
Username and display name can be set independently, you should have a “Display name” field in settings. Their non-unique display name is “max” and their unique username is “@kittykittycatboys@lemmy.blahaj.zone”. If you check their profile you should see both.
If you don’t set a display name it will be the same as your username, if you set display name to the same as username (like I have) it’ll show your username without the instance even to people on other instances.
Where would max even come from? That’s not in their username o.O
Credit bureaus are not for your protection, they’re for the protection of their clients, the banks.
This implies they’re storing the plaintext password.
Ideally the password would be hashed with a salt and then stored. Then it’s a fixed length field and it shouldn’t matter how long the password is.
Or a very very old database system, possibly DB2, where you can’t change the column limits or data types after the fact.
If they’re hashing, the column size should be irrelevant. Ideally the database should never see the plaintext password in the first place (though I could understand calculating the hash in the query itself). If they’re not hashing, they should really be rewriting their database anyway.
Salted passwords are not recommended anymore. Better to use a memory hard key derivation function designed for passwords, like Argon.
I’d rather see a paper explaining the flaws with salted passwords rather than “just use this instead”.
My initial reaction is that this overcomplicates things for the majority of use-cases, and has way more to configure correctly compared to something basic like a salted sha256/sha512 hash that you can write in any language’s standard library.
If the database of everyone’s salted password hashes gets leaked, this still gives everyone plenty of time to change passwords before anything has a chance of cracking them. (Unless you’re about to drop some news on me about long time standard practices being fundamentally flawed)
Those are salted, they just do it for you.
Where does the salt get stored?
It’s usually part of the string stored to the DB.
Edit: you can see the PHC spec here:
https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md
Which is a common format for various password storage algorithms, including Argon2. It has a salt field.
Financial institution security is quite frankly a freaking joke. My bank only has the options for 11 character passwords at maximum. It’s like oh come on that is way too easy these days
Oh but wait! That non-customizable
account numberuser ID that you have to wait for in the mail is definitely top notch security!
that is a painfully bad list of
requirementsbullshitCorrect me if I’m wrong, but the only reason to limit password length, is to save carrying cost on the database. But the only reason that this would be value added, is if the passwords are encrypted in reversible encryption, instead of hashed. Isn’t this against some CISA recommendation?
@nokturne213 In Canada, we also have transunion; they officially say max pw size is 30 but it’s actually 15. Complete joke. At least Equifax has proper 2FA.
I tried to log in to see if I could activate 2FA and it says I have to call customer service to log in now.
Don’t worry this is easily solved by sending a fax of your drivers license Mo-Fr between the hours of 8:05am and 8:09am
deleted by creator
Just wait until you get to Transunion’s site. It is a dumpster fire of consisting of the worst sign up I’ve ever seen, “Contact our social team” and "If you haven’t logged in for awhile create a new account. I could not believe how awful it was. I had to just call and do it over the phone.
Fuck1ngKil!M3
I swear password restrictions are getting to the point where there’s eventually going to only be one usable password.
Yeah, it’s counterproductive to lay out a bunch of restrictions. Let people make a long-ass password that’s a memorable phrase - it’s safer anyway.
Although I don’t know how anyone makes it without a password manager at this point.
I don’t know how anyone makes it without a password manager at this point.
Password reuse. Password reuse everywhere.
We’re all guilty of it. No shame in admitting it. I know I’ve been guilty of it from time to time.
When I have to sign up for something on my phone I will use my pre Bitwarden default password. Then once I have a sec to sit down iPad or laptop I will change it to something more secure.
I am currently fighting with my wife and children to start using a password manager.
The funny thing about that is that I am currently on my laptop getting keepassxc set up. This post has somehow motivated me to finally get a password manager.
On your phone, you can select autofill, then ask bitwarden to generate a password, save and use that to register
What’s the best password manager you’d recommend?
I have only used lastpass (they have had several breeches and I do not recommend them), Bitwarden (my current daily driver and my recommendation), and I have used Apple keychain a little for passwords at work that my wife can access without having full access to my Bitwarden.
Thank you!
I have seen this on a site before and I never understood why. Whats the point of limiting the length of the password? Its not to save storage space since the plain text isnt stored and the hash should be a uniform length. So whats the advantage?
since the plain text isnt stored
I’m not sure I’d accept a bet on that assumption.
deleted by creator
Calculating hashes is supposedly more expensive for longer strings. That could be used to simplify some kind of overload attack like DDOS.
If they’re not already rate-limiting login attempts that’s another huge problem…
If they’re using md5 (which would be in line with their security practices), the block size is 512 bits. That means that everything less than 64 characters is the same cost
I’d like to not solve a boolean satisfiability problem along the way, please.
A 20 character password of case insensitive letters and numbers is quite unbreakable (taking billions of years to brute force). Still, what a strange way to announce your database is old and you probably aren’t hashing your password with anything stronger than MD5. Or worse.
My default is to generate a 32 character password and store it in a password manager. Doesn’t matter to me how many characters it has since I’m just going to copy and paste it anyway.
Pretty surprising how many places enforce shorter passwords though… I had a bank that had a maximum character limit of 12. I don’t bank with them anymore. Short password limits is definitely is an indicator of bad underlying security practices.
A hash has a fixed length, including MD5. There’s no reason to cap password (input) Iength. You can hash the whole bible and still get the same length hash. So either they don’t even hash it, they’re idiots, or they try to be unnecessarily cautious to avoid some other limit / overflow, like POST max size (which would still be counted in at least KB, not several characters). The limit on what special characters you can use is also highly suspicious - that’s not how you deal with injections / escaping your inputs.
Hashing takes longer the longer the string is, so it technically could impact performance if many people with very long passwords log in simultaneously. 20 characters is ridiculous though, you could probably cap it at hundreds and still be completely fine.
