Edit: @[email protected] solved it. It says “one special character”. Not “at least one”.

  • xmunk@sh.itjust.works
    link
    fedilink
    arrow-up
    226
    ·
    3 months ago

    It’s fucking insane that an internet banking portal has such a low cap on max characters and such shitty rule enforcement.

    • sorter_plainview@lemmy.todayOP
      link
      fedilink
      arrow-up
      91
      ·
      3 months ago

      Their desktop site is even more shitty. It won’t allow right click or paste actions. There goes compatibility with password managers.

      • superkret@feddit.org
        link
        fedilink
        arrow-up
        59
        ·
        3 months ago

        Bitwarden has a function where it types in (not pastes) the password and shows the prompt for it without right-click.

          • tyler@programming.dev
            link
            fedilink
            arrow-up
            3
            ·
            3 months ago

            On Mac you can use Hammerspoon and just create a shortcut to hs.eventtap.keyStrokes(hs.pasteboard.getContents())

          • stetech@lemmy.world
            link
            fedilink
            arrow-up
            1
            ·
            3 months ago

            Nice find, thanks for sharing.

            For Macs (only Macs, I believe), there is StopTheMadness, which, uh well, stops the madness (test page here for some examples it can re-enable).

      • xmunk@sh.itjust.works
        link
        fedilink
        arrow-up
        38
        ·
        3 months ago

        As a super secret dev hack may I introduce you to shift + insert a fair few sites specifically block ctrl + v instead of properly disabling the clipboard action and, of course, if you read this and then submit a Jira ticket to block shift + insert… well… h8u

      • Creat@discuss.tchncs.de
        link
        fedilink
        arrow-up
        17
        ·
        3 months ago

        Any password manager should be able to “type in” the password. Or be a browser plugin that doesn’t rely on copy pasting, but use other mechanisms to inject it directly into the field.

        But yes, if that’s their online portal, I am not kidding I would change banks.

    • stealth_cookies@lemmy.world
      link
      fedilink
      arrow-up
      34
      arrow-down
      1
      ·
      3 months ago

      My bank’s password used to have to be exactly 6 characters, no special characters and you could use numbers and letters interchangeably because it was also your phone banking password.

      • hushable@lemmy.world
        link
        fedilink
        arrow-up
        43
        ·
        edit-2
        3 months ago

        a previous bank used to have a max password length of 8 characters, then proudly announced that they will increase it to 32

        Then I made a typo at the end of my password and it let me in anyway, and I realised they were just trimming the first 8 characters to give the illusion of security

        • WIZARD POPE💫@lemmy.world
          link
          fedilink
          arrow-up
          15
          ·
          3 months ago

          That is so insane. To think they would rather just clip the passwords instead of habing it be longer.

          Did you try out your hypothesis by using the first 8 letters than just random junk until you hit your password length?

          • hushable@lemmy.world
            link
            fedilink
            arrow-up
            16
            ·
            3 months ago

            I tried then first N characters of my password until I found out the threshold was at 8, then I tried with the first 8 chartacters of my password and then random junk and it worked.

            I also had two friends in the same bank to validate

    • DudeDudenson@lemmings.world
      link
      fedilink
      arrow-up
      27
      ·
      3 months ago

      Visa has a hard limit of 8 and requires the first 4 to be numbers because the phone tree might require it as a password

      The whole banking industry is ridiculous and is ridiculously legislated

      • funkless_eck@sh.itjust.works
        link
        fedilink
        arrow-up
        6
        ·
        3 months ago

        USAA has 8-12 ONLY. My smallest memorized password algorithm is 13 characters, that I typically use for throwaways, doesn’t even fit.

    • Flipper@feddit.org
      link
      fedilink
      arrow-up
      20
      ·
      3 months ago

      The ERP software I have to use has a strict limit of 6 characters as password. Only alphabet and numbers allowed.

      Maybe when I leave I try an SQL injection.

    • ImplyingImplications@lemmy.ca
      link
      fedilink
      arrow-up
      12
      ·
      3 months ago

      I had to create an account on a government website. The website didn’t list a character limit so I used a password manager to generate a 32 character password. My account was created but I couldn’t log in. I used the “forgot my password” option and I received an email of my password in plain text. I also noticed why I couldn’t log in. The password was truncated to just 20 characters. Brilliant website! Tax dollars at work!

    • kirk781@discuss.tchncs.de
      link
      fedilink
      arrow-up
      8
      ·
      3 months ago

      Some internet banking sites give access after only asking for login password. They will only ask for transaction password and OTP (that will only come on phone) later on. Asking for two passwords isn’t necessarily more secure since many people will just reuse their original one again. And OTP instead of offering something like hardware security key is insane.

      • IsoKiero@sopuli.xyz
        link
        fedilink
        English
        arrow-up
        5
        ·
        3 months ago

        My bank uses 6 digit ‘customer number’ (which is set by the bank) and that’s verified with an app and a personal PIN (app shows ‘login attempt ABCD at mm.dd. hh:mm’ where ABCD is shown on login page too) or via SMS OTP (again with ‘ABCD’ verification). And again with personal pin + app or OTP to confirm transactions. The app itself can be protected with a fingerprint or phone pin and every new installation needs to be registered to the system, so I can’t just use my phone app to access my wifes account (or anyone elses) but I still can map multiple accounts (like corporate ones) to the same installation.

        I think that’s pretty reasonable approach.

      • Appoxo@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        3
        ·
        3 months ago

        Reason why I took a hardware tan generator versus using the OTP function of one of their other apps.
        Thanks but no, I will use the old crusty method as I know how easy that’s hacked.

    • Ech@lemm.ee
      link
      fedilink
      English
      arrow-up
      5
      ·
      3 months ago

      They can’t even properly check their copy on critical infrastructure. Top notch work over there, top to bottom.

    • stoy@lemmy.zip
      link
      fedilink
      arrow-up
      7
      arrow-down
      4
      ·
      3 months ago

      It is insane that any internet banking portal still uses a static password.

    • FiskFisk33@startrek.website
      link
      fedilink
      arrow-up
      8
      arrow-down
      5
      ·
      3 months ago

      seriously, I’ve never seen a bank with password login to begin with. Every bank i know of uses physical devices that you type a code into

        • FiskFisk33@startrek.website
          link
          fedilink
          arrow-up
          9
          ·
          3 months ago

          Sweden. The little keyfob thingies have been the thing for many decades here, I would guess ever since the dawn of internet banking, but I’d have to ask my parents instead of just assuming. I used to assume that was just normal for banks in the world at large. When you want to log in, the website gives you a code, you type the code into the fob and it responds with another code you type in to the website.

          Nowadays they additionally offer login via BankID, a mobile app used throughout Sweden for personal online identification.

          • Successful_Try543@feddit.org
            link
            fedilink
            arrow-up
            8
            ·
            edit-2
            3 months ago

            As a German, when living in Sweden, I was (and still am) very impressed, how widespread the use of (Mobile) Bank ID, beside the use of the personal ID number (As a male German, the state has assigned me at least three different ones without requiring any interaction.) for basically everything, is.

            In Germany, before introducing a second electronic way of authentication for online (or phone) banking, it was done by a chosen password and a TAN (transaction number) from a list that you regularly got sent by mail in a special envelope. Later it was replaced by that “thingy”, a mobile TAN generator, or push TAN via SMS.

              • Successful_Try543@feddit.org
                link
                fedilink
                arrow-up
                5
                ·
                3 months ago

                It was not special from the outside, but from the inside. It was either the envelope or the TAN list that was printed with a special pattern to prevent reading the list by using a flashlight.

          • OTP for 2FA has just started becoming common here (US) within the last decade I think. Each bank has its own separate app and many banks seem to limit password lengths to less than other websites.

      • xoggy@programming.dev
        link
        fedilink
        arrow-up
        19
        ·
        3 months ago

        problem is the late stages of the game the password requirements change when your password’s emojis start catching fire.

        • Raxiel@lemmy.world
          link
          fedilink
          arrow-up
          2
          ·
          3 months ago

          I put that out but the stupid chicken choked while I was looking for a YouTube video 4:42 long

      • chiliedogg@lemmy.world
        link
        fedilink
        arrow-up
        3
        ·
        3 months ago

        Last time I got pretty deep in, but it became impossible when the chess notation rule required Cs and Ds, making it impossible to stay below the roman numberal sum limit.

      • Veloxization@yiffit.net
        link
        fedilink
        arrow-up
        2
        ·
        3 months ago

        I got past it because it happened to throw a place from my country. And there was also a flagpole with a flag on it to really drive it home. XD

      • seang96@spgrn.com
        link
        fedilink
        arrow-up
        2
        ·
        3 months ago

        I used Google lens. Got stuck afterwards on a chess rule. The captcha rule used the notation for the chess one to complicate it further haha

  • oo1@lemmings.world
    link
    fedilink
    English
    arrow-up
    49
    ·
    3 months ago

    If >1 special character is not allowed the last check should be failed . The second check is literally satisfied even if there are 2+ specials.

    I’d not be using that bank.

  • refalo@programming.dev
    link
    fedilink
    arrow-up
    28
    ·
    3 months ago

    Now imagine how many services just silently cut off your password at 8 characters and people never notice.

    UltraVNC is very guilty of this.

    • Buddahriffic@lemmy.world
      link
      fedilink
      arrow-up
      12
      ·
      3 months ago

      Once upon a time, battle.net passwords weren’t case sensitive. I used upper and lower case letters in my password then one day realized I didn’t hit shift for one of the caps as I hit enter out of habit, but then it still let me in instead of asking for the password again.

      It was disappointing because it takes more work to remove case-sensitivity than to leave it. I can’t think of any good reason to remove it. At least the character limit had a technical reason behind it: having a set size for fields means your database can be more efficient. Better to use the size of a hash and not store the password in plaintext, so it’s not a good reason, but at least it’s a reason.

      • lud@lemm.ee
        link
        fedilink
        arrow-up
        12
        ·
        edit-2
        3 months ago

        It’s possible that the passwords want through an old ass cobalt system or something that forced everything to be capitalized so to solve that they made everything non case sensitive.

        But even that sounds insane as the passwords should have been hashed.

      • NotAnOnionAtAll@feddit.org
        link
        fedilink
        arrow-up
        7
        ·
        3 months ago

        At least the character limit had a technical reason behind it: having a set size for fields means your database can be more efficient.

        If that is the actual technical reason behind it, that is a huge red flag. When you hash a password, the hash is a fixed size. The size of the original password does not matter, because it should not be stored anyway.

        • Buddahriffic@lemmy.world
          link
          fedilink
          arrow-up
          3
          ·
          3 months ago

          Correct, hence the sentence after the one you quoted :)

          If any service can recover your password and send it back to you rather than just resetting it for you to set a new one, don’t rely on that service for anything you want to keep secure. And certainly don’t reuse a password there, though you shouldn’t be reusing passwords anyways because who knows what they are and aren’t storing, even if they don’t offer password recovery.

          • NotAnOnionAtAll@feddit.org
            link
            fedilink
            arrow-up
            3
            ·
            3 months ago

            Sorry, didn’t want this to look like an attack or disagreement. Just wanted to highlight that point, because arbitrary maximum sizes for passwords are a pet peeve of mine.

            • Buddahriffic@lemmy.world
              link
              fedilink
              arrow-up
              3
              ·
              3 months ago

              Yeah no worries and agreed. I hate seeing commercial sites using worse password sanitization practices than I used for my first development website that wasn’t even really intended for anyone else to log in to and any max length suggests the password is either stored or processed in plaintext.

              IMO it should even be hashed on the client side before being sent so that it doesn’t show up as plaintext in any http requests or logs. Then salted and hashed again server side before being stored (or checked for login).

              • SpaceCowboy@lemmy.ca
                link
                fedilink
                arrow-up
                2
                ·
                3 months ago

                IMO it should even be hashed on the client side before being sent so that it doesn’t show up as plaintext in any http requests or logs. Then salted and hashed again server side before being stored (or checked for login).

                But if someone got that hashed version they could hack the client to have client side hashing code just send that hashed value to the server. You’d want to have the server to send a rotating token of some sort to use for encrypting the password on the client and then validate it on the server side that it was encrypted with the same token the server sent.

                Seems complicated to me… https is probably has good enough encryption, so eh, whatever.

                • Buddahriffic@lemmy.world
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  3 months ago

                  Yeah, if they are able to intercept traffic or access the logs, they probably already have other access to the account without needing the password. If you don’t reuse passwords, then your other accounts will be safe from that.

  • Matriks404@lemmy.world
    link
    fedilink
    arrow-up
    23
    ·
    3 months ago

    Your Internet Banking Password should one special character (~!@#%^&*)

    Great grammar on their part.

  • TheSealStartedIt@lemmy.world
    link
    fedilink
    arrow-up
    16
    ·
    edit-2
    3 months ago

    This was a new one for me:

    this was a new one for me

    Translation: Password strength: weak. Please don’t use any special characters.

    It was a generated 14 char password… (╯°□°)╯︵ ┻━┻)

    • Malgas@beehaw.org
      link
      fedilink
      English
      arrow-up
      7
      ·
      3 months ago

      I used to use a system that was perfectly happy to let you use a semicolon when setting the password, but then login would fail if you did.

    • marcos@lemmy.world
      link
      fedilink
      arrow-up
      6
      ·
      3 months ago

      When you enter an apostrophe, and the site returns a 500 response stating you are trying to attack it. (And yeah, it’s always 500, not 400.)

  • merc@sh.itjust.works
    link
    fedilink
    arrow-up
    14
    arrow-down
    2
    ·
    3 months ago

    Noone should of aloud this code to go out the door. Atleast alot of other people people probably complained aswell, so your apart of a bigger group, incase you were worried.

    spoiler

    And yes, this was painful to type.

  • FuglyDuck@lemmy.world
    link
    fedilink
    English
    arrow-up
    12
    ·
    3 months ago

    My guess is they mean, one capital letter, one lower case letter, a number, and a special character

    what’s always amused me about these rules is that they exist because people are dumb. Technically, they lower the difficulty of the passwords slightly. ( for example, knowning that one character is a number reduces it to 10 options in stead of 10+26+26+whatever set of special characters)

    anyhow. people should use password managers. just saying.

  • corsicanguppy@lemmy.ca
    link
    fedilink
    English
    arrow-up
    11
    ·
    edit-2
    3 months ago

    Please tell me someone didn’t buy software with ‘atleast’ spelled like that in there. Please, tell me someone tested the web app and had the brains God gave a douglas fir and knew that wasn’t a word; that it was never a word; that the writer’s spell check should have picked that up; that it’s not been over-ruled by stupid so much that it just takes it.

  • addie@feddit.uk
    link
    fedilink
    arrow-up
    9
    ·
    3 months ago

    Well now. When we’ve been enforcing password requirements at work, we’ve had to enforce a bizarre combination of “you must have a certain level of complexity”, but also, “you must be slightly vague about what the requirements actually are, because otherwise it lets an attacker tune a dictionary attack against you”. Which just strikes me as a way to piss off our users, but security team say it’s a requirement, therefore, it’s a requirement, no arguing.

    “One” special character is crazy; I’d have guessed that was a catch-all for the other strange password requirements:

    • can’t have the same character more than twice in a row
    • can’t be one of the ten-thousand most popular passwords (which is mostly a big list of swears in russian)
    • all whitespace must be condensed into a single character before checking against the other rules

    We’ve had customers’ own security teams asking us if we can enforce “no right click” / “no autocomplete” to stop their users in-house doing such things; I’ve been trying to push back on that as a security misfeature, but you can’t question the cult thinking.

      • addie@feddit.uk
        link
        fedilink
        arrow-up
        9
        ·
        3 months ago

        Because if you disable browser autocomplete, what’s obviously going to happen is that everyone will have a text file open with every single one of their passwords in so that they can copy-paste them in. So prevent that. But what happens if you prevent that is that everyone will choose terrible, weak passwords instead. Something like September2025! probably meets the ‘complexity’ requirement…

      • Midnitte@beehaw.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 months ago

        “Password managers are insecure because then all your passwords are just under one password” - Some higher up