Signed up for Equifax to freeze my credit, password can not be longer than 20 characters

no spaces in a string is a dead giveaway that theres Cobol in there somewhere meow

"We serve food sanity here, sir"

Or a very very old database system, possibly DB2, where you can't change the column limits or data types after the fact.

Salted passwords are not recommended anymore. Better to use a memory hard key derivation function designed for passwords, like Argon.

https://en.wikipedia.org/wiki/Argon2

Banks aren't much better. Up until just a couple years ago, the Treasury Direct website (to buy bonds/etc from the US Treasury) forced you to use a god damned on-screen keyboard to input your password and the passwords were not case sensitive. I'm pretty sure it also only read the first X number of characters of your input because I recall that people tried typing extra characters after their passwords and it would still accept it as valid, though I could be conflating this with some other archaic site.

Oh but wait! That non-customizable account number user ID that you have to wait for in the mail is definitely top notch security!

Honestly, that's a sign to me that your bank doesn't take cybersecurity seriously and would possibly consider switching. Mine has amazing security as well as fraud detection. Sometimes it'll even send me a text to verify a purchase if their software thinks it's weird I got across town too quickly, though that's pretty rare so it isn't overly aggressive/inconvenient.

My default is to generate a 32 character password and store it in a password manager. Doesn't matter to me how many characters it has since I'm just going to copy and paste it anyway.

Pretty surprising how many places enforce shorter passwords though... I had a bank that had a maximum character limit of 12. I don't bank with them anymore. Short password limits is definitely is an indicator of bad underlying security practices.

A hash has a fixed length, including MD5. There's no reason to cap password (input) Iength. You can hash the whole bible and still get the same length hash. So either they don't even hash it, they're idiots, or they try to be unnecessarily cautious to avoid some other limit / overflow, like POST max size (which would still be counted in at least KB, not several characters). The limit on what special characters you can use is also highly suspicious - that's not how you deal with injections / escaping your inputs.

You mean the company that had a feature in place that allowed law enforcement to request and access video footage from your devices without obtaining a warrant first?

As expected, their security measures were also found to be lacking.

Yeah, no thanks.

Thats the least of your worries with Ring. Put that shit straight into the bin.

Sure would be a shame of Bobby tables made a ring acct

Then wash the code! Son's of bitches!

Eufy cameras will not allow spaces in the WiFi password.

I encountered something like this at work. It wasn’t pass related, it was just a means of getting people to make text responses. Ampersands were replaced with some gibberish format, which annoyed everyone.

I got some kind of explanation from our tech people, which I understood to mean that ampersand was used to indicate that what followed was live code. Turning the ampersand into gibberish text was a safety measure to stop mischief.

I’ve noticed ampersand replacements in some news feeds too

Except todays wordle answer cannot be made to multiply to 35

I got to rule #16 - I suck at chess. Secret to “multiply roman numerals” is just add them up to the value.

Rule 5 The digits in your password must add up to 25.

that they collect without your explicit consent

You signed a contract? Pretty sure they're going to fuck it up either way and they definitely have all your data.

My bank disables paste as has code checking if the browser is greater than Netscape Navigator 4.

Yup. My bank was even "translating" passwords to PINs behind the scene specifically so your password for the website would be the same as your password on the telephone.

And my bank wont accept ANY special characters.

And I use password manager, I don't care of its 52 chars long, I just use the software to fill the field

I recommend Diceware for generating memorable passwords of sufficient complexity...but also, a password manager.

I use a 5 word phrase generated by my password locker. I will add a symbol or three to it if required.

They’re supposed to be hashed so that shouldn’t matter

Unless that’s the joke or something

Yeah, it's counterproductive to lay out a bunch of restrictions. Let people make a long-ass password that's a memorable phrase - it's safer anyway.

Although I don't know how anyone makes it without a password manager at this point.

Transunion was not too bad, and they did not require my full SSN, unlike Equifax. But transunion will not easily give me my credit score unlike the two Es.

since the plain text isnt stored

I'm not sure I'd accept a bet on that assumption.

Their backend is really, REALLY garbage. Maybe it is some of that Microsoft trash that they snake oil'd into a lot of public offices and dumbass corpo managers, but whatever is running that site, has me concerned. You don't do fucky things with passwords unless your backend is doing something really stupid.

Calculating hashes is supposedly more expensive for longer strings. That could be used to simplify some kind of overload attack like DDOS.

One other reason I could see is pure idiocy. Like I've seen that there is a bias to using every feature some software has, and if a max limit can be set, it will be set, to a "reasonable" value.

Even then, the difference between 20 and 2000 characters is negligible

There may also be a (very weak) reason around bounds checking and avoiding buffer overflows. By rejecting anything longer that 20 characters, the developer can be sure that there will be nothing longer sent to the back end code. While they should still be doing bounds checking in the rest of the code, if the team making the UI is not the same as the team making the back end code, the UI team may see it as a reasonable restriction to prevent a screw up, further down the stack, from being exploited. Again, it's a very weak argument, but I can see such an argument being made in a large organization with lots of teams who don't talk to each other. Or worse yet, different contractors standing up the front end and back end.

"Cannot contain your email address" - damn right it can't contain my email address in 20 characters!

Just a quick tip: I've had good luck getting insurance through a broker. I have cheaper insurance through some B2B place that doesn't work directly with consumers with better coverage than if I went through some national brand that spends millions of dollars a month on advertising to consumers. The other benefit of a broker is now you have a third party who's incentivized to not only find you the best deal but also someone you can get advice from during a claim should anything seem off to you.

I tried to log in to see if I could activate 2FA and it says I have to call customer service to log in now.

Twitch is bad about this. It's not a fucking ballistic missile installation - just tell me what you want.

There shouldn't be an arbitrary limit on the length of a password but how is 20 characters "way too short"? It's more than 10^36 combinations.

I almost used my proton mail because I can create an alias, where equifax would not accept a plused gmail account.

I think 12345678901234aB+ would work though. If I am able to log in (I currently have to call customer service to be able to log in) I will try both of these passwords and see if either is accepted.

I tend to prefer pass phrases, they are a lot easier to type and speak, if required. Mine regularly blow past 20 characters.

As for salting, that only defends against rainbow table attacks. The salt needs to be stored along with the hash. That is find for most accounts, but once you're in banking territory, that's a bad bet.

You also can't assume you have no vulnerabilities. If someone gets your database, you can't defend against brute force attacks.

Lastly, if you are doing passwords properly, you shouldn't care much about length. There are a few dos attacks to worry about, but a 512 char limit will stop those, and not limit any sane password.

That's not how salt works. It will be stolen alongside the password hash, because salt is necessarily in plaintext. It doesn't increase the guessability of passwords. It just makes it infeasible to precompute your guesses.

The actual length of the password isn't the problem. If they were "doing stuff right" then it would make no difference to them whether the password was 20 characters or 200, because once it was hashed both would be stored in the same amount of space.

The fact that they've specified a limit is strong evidence that they'renot doing it right