What is the max allowed length for your online bank password?

[Modelworks]

You would hope that after a few attempts they would lock your account and require you to call in to reactivate.

My bank does this. 3 wrong entries and you have to call to reset the account.
My bank also does security questions randomly when you use the account. One day it might not ask anything, the next it will ask things like mothers maiden name.

 

[Deeko]

Haha. I have that comic printed out and put in my cube. Sadly, a lot of websites/services have stupid password rules where they will require you to put in a character, or a number, or whatever. I know it isn't smart, but I like my passwords to be the same across all sites. With all the different site rules, I can't do a password scheme similar to the comic.

Particularly those that block dictionary words, too.

 

[Red Storm]

Yeah my student loan account has the most annoying rule where if you change your password, it can't be anything close to the previous one, so I change it enough to be different but still similar to my "go to" password. This has led to me basically having no idea what the right password is at any given point, so I have to do a password reset every time I want to log in (maybe once every couple months).

 

[DnetMHZ]

I actually use lastpass. I don't know any of the passwords for any website I use.

I don't know my gmail password. I dont know my slashdot password. I don't even know the password I use on this forum.

I do auto generate them at the maximum length allowed by the website. The only password I do know is my lastpass master password.

This.. plus I have 2 factor on my lastpass as well.

 

[Anubis]

i dont have an online bank password. actually im not even sure my bank has any online features

 

[Jeff7]

Haha. I have that comic printed out and put in my cube. Sadly, a lot of websites/services have stupid password rules where they will require you to put in a character, or a number, or whatever. I know it isn't smart, but I like my passwords to be the same across all sites. With all the different site rules, I can't do a password scheme similar to the comic.

Unfortunately, I think a lot of those password rules were developed back when the main concern was another person getting into your account. Now we've got insanely fast computing tech available at the consumer level, but the rules haven't changed. So, that f7x!T9 password would be nearly useless. Mixed case, punctuation, numbers...HowSecureIsMyPassword.net says 13 minutes for a desktop PC to crack that one. But, copy/paste that same password 5 times, and that bumps up to a pretty damn long time, assuming they're not also trying for repeated patterns, though that would also increase the processing time. So ok, fine - paste it 5 times, then add a single character at the end.

 

[D1gger]

https://www.grc.com/haystack.htm

interesting site to see the difference in hacking times for various password character types and lengths.

 

[D1gger]

i dont have an online bank password. actually im not even sure my bank has any online features

What type of financial institution is this? A tin can buried in your back yard?

 

[Anubis]

What type of financial institution is this? A tin can buried in your back yard?

local bank, i know the bank president, i bitched at her the other day when i saw her out at dinner. the issues i was having were fixed by 9 am the next day. having the ability to do that is much greater then any online features

also they are open on saturday

 

[Deeko]

Unfortunately, I think a lot of those password rules were developed back when the main concern was another person getting into your account. Now we've got insanely fast computing tech available at the consumer level, but the rules haven't changed. So, that f7x!T9 password would be nearly useless. Mixed case, punctuation, numbers...HowSecureIsMyPassword.net says 13 minutes for a desktop PC to crack that one. But, copy/paste that same password 5 times, and that bumps up to a pretty damn long time, assuming they're not also trying for repeated patterns, though that would also increase the processing time. So ok, fine - paste it 5 times, then add a single character at the end.

Haha according to that, the simple phrase I created as a shared password for things like hulu and blockbuster is by far the most secure password I've ever made, despite being all lower case with no numbers or symbols. 212,000 years! Meanwhile, my standard "strong" password is 85 days, and my password I use on Anandtech is, uh, 8 seconds.

 

[BoberFett]

length != security

Wrong.

 

[BoberFett]

How are they going to test those 2.8 billion passwords per second? That speed does not appear to be relevant in anyway if they cannot recognize / use what they have.

By matching against the hash they pulled off of a tape that some careless backup operator left in their front car seat?

There are more data breaches from carelessness than there are from uber l33t internet hackers, and you're far less likely to know about the former so you don't even know you should change your password.

 

[Jeff7]

Haha according to that, the simple phrase I created as a shared password for things like hulu and blockbuster is by far the most secure password I've ever made, despite being all lower case with no numbers or symbols. 212,000 years! Meanwhile, my standard "strong" password is 85 days, and my password I use on Anandtech is, uh, 8 seconds.

The only thing is, I don't think that password site does a dictionary search.
So if you're using XKCD's "correct horse battery stapler" approach, that's a lot of characters, but it's also only 4 words.
But of course, that's dependent upon the approach that a cracker would use. Lowercase-only dictionary search first, or just do a character-by-character brute force attack?

 

[TakeNoPrisoners]

20 characters, and my password maxes it out.

 

[Deeko]

The only thing is, I don't think that password site does a dictionary search.
So if you're using XKCD's "correct horse battery stapler" approach, that's a lot of characters, but it's also only 4 words.
But of course, that's dependent upon the approach that a cracker would use. Lowercase-only dictionary search first, or just do a character-by-character brute force attack?

Right. Although I imagine dictionary searches are more effective when checking if the whole password is one word (which a lot of people do) - a multiple word phrase, particularly one that doesn't make much sense (like the xkcd one), would take a lot of combination checking to find, and like you alluded to, I doubt most crackers would turn to that first, since its such a rare type of password.

 

[alkemyst]

length != security

hmm it actually is.

6 characters is far to short for a serious password as you approach 20 characters the potential of it been brute forced goes to almost nill.

What's really bad are those that specify you must be between 8 and 12( to 16) characters and require a beginning Capital Letter and ending in a number...

 

[alkemyst]

By matching against the hash they pulled off of a tape that some careless backup operator left in their front car seat?

There are more data breaches from carelessness than there are from uber l33t internet hackers, and you're far less likely to know about the former so you don't even know you should change your password.

as well as being inside jobs.

 

[dabuddha]

hmm it actually is.

6 characters is far to short for a serious password as you approach 20 characters the potential of it been brute forced goes to almost nill.

What's really bad are those that specify you must be between 8 and 12( to 16) characters and require a beginning Capital Letter and ending in a number...

Considering that most login systems (at least if it's a good one) will lock out your account after 3 failed attempts, I'd say shorter is better. Especially considering how many people end up writing down their passwords because of the asinine password requirements for some sites make it extremely difficult to memorize it.

 

[BoberFett]

as well as being inside jobs.

That too.

 

[sourceninja]

Right. Although I imagine dictionary searches are more effective when checking if the whole password is one word (which a lot of people do) - a multiple word phrase, particularly one that doesn't make much sense (like the xkcd one), would take a lot of combination checking to find, and like you alluded to, I doubt most crackers would turn to that first, since its such a rare type of password.

Right, a mult-word password makes the dictionary attack much less valuable. First, you need to know if I'm using a sentence, a few words, a common phrase, what language am I using, are all my words from the same language.

if my password was "Osotogari is winning technique" as a reference to my judo background, do you think a dictionary attack would find it?

For one, I have a word that is not english, for another does your dictionary attack use small words like a, an, is, the or would you skip them? What if I had proper names in my password like "Grandpa was a O'Rilley"? Do you search with proper caps or without proper caps, or with all words caps? What if it uses non-word characters (like text messaging) example: "lunch @ titos w/ beer"?

The point is that when you do a phrase of some kind you make the variables a lot more complex then just a "list of words". It would probably be easier to brute force a phrase then it would be to use a dictionary attack.

 

[bruceb]

I know mine will take at least 16 characters, but it will not accept things like - or & and other special characters. It really should, but you can combine upper and lower case.

 

[The-Noid]

My bank has a RSA Securid and password. The password and RSA key also have a pop up on screen keyboard that where the keys are pressed via mouse rather than typed in for keyloggers.

I feel safe.

 

[bruceb]

That SecureID is a nice idea. We used them at Verizon to log onto corporate applications. And that was from within a Verizon office, on their internal network. They should be mandatory for any financial website access. I think they are uncrackable, as the number changes about once a minute.

 

[MotionMan]

At least 8 characters. Could be more, but I doubt it.

MotionMan