Until just 8 years ago one of the major Canadian nationwide banks was provably storing peoples' online banking logins in plaintext in some ancient mainframe database system. If you got to a sufficiently high level of customer service people in an account recovery process (like executor/probate process for the deceased) they could literally read back to you the entire password letter for letter.
Yes, as the result of certain acquisitions, much as you can see the banks that TD acquired and rebranded particularly on the US east coast. But not everywhere and not as prevalent as like a Bank of America or Wells Fargo or Citibank. There's huge swathes of the US that have zero BMO brand name presence.
Additionally First Citizens acquired a bunch of "BMO" branchs and is presumably converting them back to their branding.
I mean literally like if the person's password was "potato##!" the customer service person would read back "potato##!". They weren't reading the encrypted contents of a pw field.
their point is it could have been stored encrypted and then decrypted for the customer service person to read back to you. Access to plain text != storing it as plain text.
All my worst experiences with password length have been banking and finance and it boggles my mind that they all get something so incredibly basic so incredibly wrong. What is it about this sector that makes it so?
One of my most favorite things in the world was when an org with an outdated security program told me we'd have to rotate our passwords monthly. Then I'd get to tell them that no, we wouldn't, and due to modern security practices, we couldn't without causing a compliance exception.
Sometimes I ended up explaining that to a well-meaning but overworked person who just wasn't aware of the "new" (cough 2017) standard, but they'd ask me for the citation and giggle gleefully, thrilled that they could show their boss that they could knock off that obsolete ritual.
Sometimes I ended up with someone a little smug, because they were at a megacorp and I wasn't, and you'd see the momentary flicker of surprise and uncertainty as they started to wonder if maybe they'd missed something, something very important. I took an unreasonable amount of joy from those interactions.
In Argentina our password is called username, it gets the password treatment, but the UIs call it login.
I think it has to do with the fact that Banks are heavily driven by nation law and regulation, so it's not engineering folk that are at the helm, rather it's driven by natural language source code written by non technical people that compiles to target code through engineering lackeys. It works for the most part, but you get very weird failure modes.
There's an inherent insularity to security groups or fraud teams; they have to have a professional suspicion of everything. This can go wrong and end up being NIH or gratuitously customer-unfriendly.
Also, for finance specifically : " A sound banker, alas, is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional way along with his fellows, so that no one can really blame him." - Keynes
I think they use some cursed (or secure I guess) combo of stringent special character requirements, no reuse of old passwords, and automatic resets after incorrect guesses.
It actually hasn’t been an issue after finally using a password manager, but I remember it being a regular headache before that.
At least let me actually use a security key! PayPal already lets you use security keys for 2FA, but it appears they only allow for smartphone based passkeys for some reason. I'm sure these are behind all the TPMs and Secure Enclaves and whatnot, but a security key is still orders of magnitude safer.
When the consequences for failure are very high but personal reward for success is very low, everyone does everything they can to avoid being held responsible for the consequences.
I got bit by a similar issue with another service.
I could log into the website just fine, but the app kept saying my password was wrong. I reset my password, and when I was generating a new password, I found the root cause:
At some point, they changed the password policy to have a maximum length of 16 characters. My existing 20 character password worked fine in the website which didn't actually enforce a 20-character limit in the password field, but the app was silently truncating the last 4 characters when BitWarden was filling in the field.
Limiting password length to only 16 characters scares me. It makes me think they're not hashing passwords in the back end.
TFA says the mobile app works (so presumably the backend accepts long passwords fine). Looks like it's just a frontend issue. I wonder if deleting the maxlength attribute before submitting the form works fine?
bcrypt famously only looks at the first 72 bytes of the input. There are ways around that - don't use bcrypt, or do bcrypt(sha256(password)), or whatever, but it is not the case that "just feed the input to the hash" removes all length restrictions
It's a good habit to always create an upper bound on things (input max length, queue size, etc).
The person who wrote it just came up with 20 in the moment and forgot to go check, something everyone has done a hundred times.
I've probably never worked on a single system where the html validation, http server validation, and database constraint were synchronized on username max length. You choose a placeholder, an even number between 10 and 16, then forget to ever check.
CREATE TABLE passwords (
email VARCHAR(MAX),
password VARCHAR(20) UNIQUE -- unique passwords are more secure.
-- NOTE: "20" here because we used to use SHA1 hashes
-- but there was an issue with storing binary in CP437
-- so we just renamed the field.
)
At some point you don't want people to enter the bee movie script, but where the word "bee" was replaced with the entire bee movie script again, recursively three times, all into the password field and tie up servers with extremely long requests.
If your web server isn't throwing a 413 Content Too Large immediately after seeing a "Content-length: 20000000000" header, or bailing out after enough chunks from a "Transfer-Encoding: chunked" header, you configured it wrong.
These are the same companies that state that users are responsible for choosing secure passwords… and then they make this as difficult as possible to do.
Finance needs to be held accountable. They’ve skim off far too much wealth for the value they produced.
Well, in the USA as it is, they are already accountable under Reg E for any fraud losses due to a failure of an "access device" aka password. I'm not sure what else you would want.
Locking you out after a few wrong tries only protects against online attacks. If someone gets access to the database, they have as many attempts as they want.
> This is one example why we shouldn't use the maxlength attribute on the password field.
While I acknowledge your issue is incredibly frustrating, it is still good practice to use the maxlength attribute. Yes, it can be bypassed. Yes, you should still check the length on the backend. But it’s one more layer of ensuring sanitary input. Obviously, companies should do a better job of communicating the maximum password length to the user, properly setting the attributes on all inputs, AND if they do enforce a max length, having it be large enough that it ensures a secure password, but we shouldn’t just abandon using the HTML attribute altogether.
Can you elaborate how this sanitizes input on a password field? What unsanitary password input does it prevent?
I think statement from TFA basically boils down to "stop enforcing maxlengths on passwords, neither in the form field nor the DB". I'm no security expert but I'm a `correct horse battery staple`-adherent so if anything, password fields should have a minimum length, not maximum. Short passwords should be what's considered dirty.
> Of course, my generated password is longer than 20 characters
Ok, yes - an undisclosed max length that doesn’t throw an error is horrible, *and this is entirely Vanguard’s fault* but what’s with the “of course”?
There’s virtually no reason to use a randomly generated password that long, and there have been more than enough stories, anecdotes etc about sites failing on long passwords that throwing an “of course” here is a little overboard.
A high entropy random password with 62+ potential characters before including “special characters” with a length of 16 characters is basically un-bruteforceable. It would take 4.6 billion years to brute force at 164.1 billion guesses per second, and vanguard (or anyone else) is gonna notice if you try the 4.77 × 10^28 possible combinations.
You are right about high entropy short-ish passwords but almost nobody does that. Virtually everybody chooses something not just low entropy but often easily crackable with good search heuristics. Why not give people another way to produce passwords that are harder to crack? With luck, at least a few people will choose a correct-horse-battery-staple.
There are more of these than you think and its usually financial institutions. I started running into it years ago when I started using a password manager which allowed to generate strings > 20 chars. Most sites worked, but a few key financial sites not so much. I went through the same frustration cycle as, you finally looking at the html. What is even worse is when someone uses DIFFERENT limits for their app vs web.
recently i noticed logging into vanguard that if I use firefox autofill password, vanguard always says my password is incorrect, but typing it manually it works. I could clear my password from firefox, type it correctly and login, select "remember my password", log back out and back in, and then have it rejected.
so I figured that the way to make it work is to have it autofill, then select my username and press space then backspace, which is a no-op. That way, the javascript knows i've entered something, and then it works.
I had the opposite issue with my power company for a while. The login page had a maxlength but the reset page didn't, so I had a password set that I couldn't enter... at least without modifying the page
My hot take is that almost nobody should be setting _any_ length or complexity requirements on passwords. Instead just enforce the need for at least some kind of second factor, even if it's SMS, TOTP or a magic link by email.
If your password hash database is compromised you're screwed anyway, because dictionary attacks scale horizontally, even with slow hashes designed for passwords 'LickMyLiver123!!' isn't necessarily going to hold up just because it's 16 characters.
The average vocabulary of a 20 year old native English speaker is perhaps ~50,000 words and I bet when you apply some basic grammar rules, and pragmatic search paths like relying on tonnes of people just smashing !'s on the end of their usual password when a minimum length is enforced, those hashes start to fall quickly.
I should have kept track of how many times I’ve run into this exact issue. I can’t recall which ones specifically, but I am confident it’s been at least three separate services.
I commented elsewhere in this thread about how a major Canadian bank used to require exactly 6 character passwords. Makes me think some of these finance industry dinoaurs had (have?) some of the same ancient back-end systems where they're storing it.
I had a financial advisor tell me once that he loves Vanguard because once he sends people there to buy index funds the web interface is so utterly TERRIBLE that people can't ever figure out how to sell :)
Their website isn't great (and the new modern one is worse, IMHO), but it doesn't seem significantly harder to sell there than any of the other brokerages I've used. But I haven't used any of the new school party brokerages with confetti effects and whatever.
It's way better than doing anything with computershare.
The wording is such that it doesn't have "sell for cash" or "cash out" language so the hoi polloi with room temperature IQ can't figure it out without paid guidance. Instead it asks you to go to click on your account, transact, (assuming you have e.g. VOO) trade ETFs and stocks, cross reference your securities of choice by typing them in (you have to look up their code from the Holdings tab and note it down or remember it), put in how many shares, or calculate how many dollars worth you need. Finally, there are four scary looking sell order types with no default. You have to actually understand what each means to determine if you want it.
The why is people who don't actually understand security but once took a class that taught them about SQL injection and used that to parlay themselves into a role that weren't qualified for as a "security expert". That's the basic why.
Until just 8 years ago one of the major Canadian nationwide banks was provably storing peoples' online banking logins in plaintext in some ancient mainframe database system. If you got to a sufficiently high level of customer service people in an account recovery process (like executor/probate process for the deceased) they could literally read back to you the entire password letter for letter.
And just ten years ago BMO required passwords to be exactly 6 char, no more, no less: https://www.reddit.com/r/PersonalFinanceCanada/comments/4t0m...
For the Americans who might not be aware of what BMO is (it's not some podunk small town bank): https://en.wikipedia.org/wiki/Bank_of_Montreal
> For the Americans who might not be aware of what BMO is
Maybe news hasn't traveled north and broadcast on the CBC, so maybe you haven't heard, but BMO has branches all over the US.
Yes, as the result of certain acquisitions, much as you can see the banks that TD acquired and rebranded particularly on the US east coast. But not everywhere and not as prevalent as like a Bank of America or Wells Fargo or Citibank. There's huge swathes of the US that have zero BMO brand name presence.
Additionally First Citizens acquired a bunch of "BMO" branchs and is presumably converting them back to their branding.
https://www.google.com/search?client=firefox-b-d&q=first+cit...
I mean that could still be encrypted. But passwords should never be reversible. It should be hashed with scrypt or apparently now Argon2id.
I mean literally like if the person's password was "potato##!" the customer service person would read back "potato##!". They weren't reading the encrypted contents of a pw field.
That doesn’t mean that it is stored as plain text. It just means that it isn’t hashed.
I agree that it any system that allows this IS almost certainly just storing as plain text, and that it’s bad regardless.
their point is it could have been stored encrypted and then decrypted for the customer service person to read back to you. Access to plain text != storing it as plain text.
All my worst experiences with password length have been banking and finance and it boggles my mind that they all get something so incredibly basic so incredibly wrong. What is it about this sector that makes it so?
One of my most favorite things in the world was when an org with an outdated security program told me we'd have to rotate our passwords monthly. Then I'd get to tell them that no, we wouldn't, and due to modern security practices, we couldn't without causing a compliance exception.
Sometimes I ended up explaining that to a well-meaning but overworked person who just wasn't aware of the "new" (cough 2017) standard, but they'd ask me for the citation and giggle gleefully, thrilled that they could show their boss that they could knock off that obsolete ritual.
Sometimes I ended up with someone a little smug, because they were at a megacorp and I wasn't, and you'd see the momentary flicker of surprise and uncertainty as they started to wonder if maybe they'd missed something, something very important. I took an unreasonable amount of joy from those interactions.
Don't forget blocking paste!
It baffles me why so many sites have blocking paste on bank account number inputs like it is 1995 and we are typing it from checks.
In Argentina our password is called username, it gets the password treatment, but the UIs call it login.
I think it has to do with the fact that Banks are heavily driven by nation law and regulation, so it's not engineering folk that are at the helm, rather it's driven by natural language source code written by non technical people that compiles to target code through engineering lackeys. It works for the most part, but you get very weird failure modes.
There's an inherent insularity to security groups or fraud teams; they have to have a professional suspicion of everything. This can go wrong and end up being NIH or gratuitously customer-unfriendly.
Also, for finance specifically : " A sound banker, alas, is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional way along with his fellows, so that no one can really blame him." - Keynes
Don't be so hard on them. Their COBOL program is probably limited to 80 character records, so they'll fit on a punched card.
+1, plus Ticketmaster for some reason.
I think they use some cursed (or secure I guess) combo of stringent special character requirements, no reuse of old passwords, and automatic resets after incorrect guesses.
It actually hasn’t been an issue after finally using a password manager, but I remember it being a regular headache before that.
Don't get me started on passkeys, where it seems it was made for people who literally only use one device: their phone.
Every time I prodded for a passkey I have to run a grep in my brain, what app did I use, or what it an extension, under my personal or work email?
A NIGHTMARE, and for what.
At least let me actually use a security key! PayPal already lets you use security keys for 2FA, but it appears they only allow for smartphone based passkeys for some reason. I'm sure these are behind all the TPMs and Secure Enclaves and whatnot, but a security key is still orders of magnitude safer.
My passkey is stored in my password manager and is available across devices with no hassle.
Fear of the Compliance monster.
Compliance over action.
Ass covering instead of responsibility.
Security theatre, in other words.
When the consequences for failure are very high but personal reward for success is very low, everyone does everything they can to avoid being held responsible for the consequences.
Note that I didn’t write “avoid consequences”!
That’s different.
Probably PCI and other regulations making it difficult to use and thus learn good software, so they develop entire ecosystems in-house
I got bit by a similar issue with another service.
I could log into the website just fine, but the app kept saying my password was wrong. I reset my password, and when I was generating a new password, I found the root cause:
At some point, they changed the password policy to have a maximum length of 16 characters. My existing 20 character password worked fine in the website which didn't actually enforce a 20-character limit in the password field, but the app was silently truncating the last 4 characters when BitWarden was filling in the field.
Limiting password length to only 16 characters scares me. It makes me think they're not hashing passwords in the back end.
My biggest question here is are they not just feeding the input into a hash function, why can't it be longer than 20 characters?
TFA says the mobile app works (so presumably the backend accepts long passwords fine). Looks like it's just a frontend issue. I wonder if deleting the maxlength attribute before submitting the form works fine?
bcrypt famously only looks at the first 72 bytes of the input. There are ways around that - don't use bcrypt, or do bcrypt(sha256(password)), or whatever, but it is not the case that "just feed the input to the hash" removes all length restrictions
It's a good habit to always create an upper bound on things (input max length, queue size, etc).
The person who wrote it just came up with 20 in the moment and forgot to go check, something everyone has done a hundred times.
I've probably never worked on a single system where the html validation, http server validation, and database constraint were synchronized on username max length. You choose a placeholder, an even number between 10 and 16, then forget to ever check.
That just made me twitch so hard that I have a crick in my neck.
At some point you don't want people to enter the bee movie script, but where the word "bee" was replaced with the entire bee movie script again, recursively three times, all into the password field and tie up servers with extremely long requests.
But 20 characters is simply ridiculous.
<input type="password" maxbeemovierecursions="2">
It had to be restricted after someone started using a complete Wikipedia database dump as a password.
If your web server isn't throwing a 413 Content Too Large immediately after seeing a "Content-length: 20000000000" header, or bailing out after enough chunks from a "Transfer-Encoding: chunked" header, you configured it wrong.
Are you looking for the technical reason or the political one?
These are the same companies that state that users are responsible for choosing secure passwords… and then they make this as difficult as possible to do.
Finance needs to be held accountable. They’ve skim off far too much wealth for the value they produced.
Well, in the USA as it is, they are already accountable under Reg E for any fraud losses due to a failure of an "access device" aka password. I'm not sure what else you would want.
> they make this as difficult as possible to do.
They provided password requirements which he ignored.
> Finance needs to be held accountable.
Accountable for what, exactly?
if the requirements make it less secure, isn't that the issue op is complaining about? max lengths are an anti feature.
Do you believe a 64-character password is magically more secure than a 20-character when they lockout your account after a few wrong tries? Delusion.
Locking you out after a few wrong tries only protects against online attacks. If someone gets access to the database, they have as many attempts as they want.
Brute force a strong 20 character password? Won't the sun have burnt out by the time that is done?
I use strong 12 character passwords at work, on the off chance i have to type them out. And as a favour to anyone else that might have to.
> 64-character password is magically more secure than a 20-character
Not magic there, just information theory. but yes, I hear what you are trying to say. It is more cumbersome.
If an attacker compromises the server and gets hashes, yes it could matter.
Sure give or take a few million years.
A 20 character password is for all practical purposes mathematically immune to being brute forced.
> They provided password requirements which he ignored.
No, you misunderstood what happened: "Chrome inputs only abcdefghijklmnopqrstu (20 characters) as shown below"
1Password generated a password longer than 20 characters. When pasted, Chrome silently truncates the paste to the input maxlength!
Look at the screenshot: The requirement "Between 8 to 20 characters long" has a green checkmark, because the requirement is satisfied.
And if someone gets into your account and robs you, that's your problem too!
> This is one example why we shouldn't use the maxlength attribute on the password field.
While I acknowledge your issue is incredibly frustrating, it is still good practice to use the maxlength attribute. Yes, it can be bypassed. Yes, you should still check the length on the backend. But it’s one more layer of ensuring sanitary input. Obviously, companies should do a better job of communicating the maximum password length to the user, properly setting the attributes on all inputs, AND if they do enforce a max length, having it be large enough that it ensures a secure password, but we shouldn’t just abandon using the HTML attribute altogether.
Can you elaborate how this sanitizes input on a password field? What unsanitary password input does it prevent?
I think statement from TFA basically boils down to "stop enforcing maxlengths on passwords, neither in the form field nor the DB". I'm no security expert but I'm a `correct horse battery staple`-adherent so if anything, password fields should have a minimum length, not maximum. Short passwords should be what's considered dirty.
> Of course, my generated password is longer than 20 characters
Ok, yes - an undisclosed max length that doesn’t throw an error is horrible, *and this is entirely Vanguard’s fault* but what’s with the “of course”?
There’s virtually no reason to use a randomly generated password that long, and there have been more than enough stories, anecdotes etc about sites failing on long passwords that throwing an “of course” here is a little overboard.
A high entropy random password with 62+ potential characters before including “special characters” with a length of 16 characters is basically un-bruteforceable. It would take 4.6 billion years to brute force at 164.1 billion guesses per second, and vanguard (or anyone else) is gonna notice if you try the 4.77 × 10^28 possible combinations.
You are right about high entropy short-ish passwords but almost nobody does that. Virtually everybody chooses something not just low entropy but often easily crackable with good search heuristics. Why not give people another way to produce passwords that are harder to crack? With luck, at least a few people will choose a correct-horse-battery-staple.
https://xkcd.com/936/
My 1password actually generates 4 random words with symbols and numbers as delimiters. A generated password is often ~24 characters.
Vanguard needs a full tech overhaul, a clean sweep. The website is legitimately amateur hour and has been for decades.
There are more of these than you think and its usually financial institutions. I started running into it years ago when I started using a password manager which allowed to generate strings > 20 chars. Most sites worked, but a few key financial sites not so much. I went through the same frustration cycle as, you finally looking at the html. What is even worse is when someone uses DIFFERENT limits for their app vs web.
recently i noticed logging into vanguard that if I use firefox autofill password, vanguard always says my password is incorrect, but typing it manually it works. I could clear my password from firefox, type it correctly and login, select "remember my password", log back out and back in, and then have it rejected.
so I figured that the way to make it work is to have it autofill, then select my username and press space then backspace, which is a no-op. That way, the javascript knows i've entered something, and then it works.
I had the opposite issue with my power company for a while. The login page had a maxlength but the reset page didn't, so I had a password set that I couldn't enter... at least without modifying the page
My hot take is that almost nobody should be setting _any_ length or complexity requirements on passwords. Instead just enforce the need for at least some kind of second factor, even if it's SMS, TOTP or a magic link by email.
If your password hash database is compromised you're screwed anyway, because dictionary attacks scale horizontally, even with slow hashes designed for passwords 'LickMyLiver123!!' isn't necessarily going to hold up just because it's 16 characters.
The average vocabulary of a 20 year old native English speaker is perhaps ~50,000 words and I bet when you apply some basic grammar rules, and pragmatic search paths like relying on tonnes of people just smashing !'s on the end of their usual password when a minimum length is enforced, those hashes start to fall quickly.
I should have kept track of how many times I’ve run into this exact issue. I can’t recall which ones specifically, but I am confident it’s been at least three separate services.
I remember a while ago (~2013?) Schwab used to silently! truncate all passwords to 8 characters. Incredible stuff.
I commented elsewhere in this thread about how a major Canadian bank used to require exactly 6 character passwords. Makes me think some of these finance industry dinoaurs had (have?) some of the same ancient back-end systems where they're storing it.
Any they don't support TOTP but support passkeys and SMS for 2FA. WTF
> As it turns out, the password field on the login page doesn't set maxlength to 20.
This is the real problem. They let him set a password they did not accept.
I had a financial advisor tell me once that he loves Vanguard because once he sends people there to buy index funds the web interface is so utterly TERRIBLE that people can't ever figure out how to sell :)
Their website isn't great (and the new modern one is worse, IMHO), but it doesn't seem significantly harder to sell there than any of the other brokerages I've used. But I haven't used any of the new school party brokerages with confetti effects and whatever.
It's way better than doing anything with computershare.
This would be funny if it were true, but the buy/sell/exchange is right by each asset listing.
The wording is such that it doesn't have "sell for cash" or "cash out" language so the hoi polloi with room temperature IQ can't figure it out without paid guidance. Instead it asks you to go to click on your account, transact, (assuming you have e.g. VOO) trade ETFs and stocks, cross reference your securities of choice by typing them in (you have to look up their code from the Holdings tab and note it down or remember it), put in how many shares, or calculate how many dollars worth you need. Finally, there are four scary looking sell order types with no default. You have to actually understand what each means to determine if you want it.
Its probably for the best.
Allegedly the new website is coming https://investor.vanguard.com/new-vanguard-experience
The thing that always gets me is when certain characters are not allow. Whyyy
The why is people who don't actually understand security but once took a class that taught them about SQL injection and used that to parlay themselves into a role that weren't qualified for as a "security expert". That's the basic why.
[self-promotion] This is exactly why my browser extension StopTheMadness has a feature to warn when your paste or typing exceeds the input maxlength: https://apps.apple.com/app/stopthemadness-pro/id6471380298