Out of interest and because it infuriates me, I was wondering if SOmebody here might happen to work for a bank or otherwise know the answer to this.
I’ve used a few online banking sites (UK and N.America) and they universally enforce a password pattern of /[\w\d]{6,8}/ Sometimes, maybe you get to use underscore, but never ever do you get to have /.{6,20}/ that you get (more or less) with just about every !banking site you’ll encounter.
I have been told that this is to do with storage space, but the maths don’t seem to support that. Assuming that banks keep shadow tables for your password record, let’s generously say an average of 10 per account, then doubling the allowed length of the password and doubling the bit width of the character set based on an 8char 8bit existing format means an extra 11*2*8 = 176 bytes per account, so ~168Mb per 1M accounts. Let’s say it’s a gigantic bank supporting 100M accounts – that’s still only 16Gb!
It can’t be that simple can it? Surely my numbers are off base.
Or is the answer here that banks being banks they have no better reason for this than they’re plodding dinosaurs.
Does anyone know a technical reason why my password for http://www.random.com/forum is stronger than the one for my bank?
I actually work in a bank right now, and have worked in quite a few in the past.
The primary reason that this happens is that in general the people who are ultimately responsible for making these decisions are not the people who end up implementing them. The ‘Business Unit’ of a bank are the non-technical business experts who end up making these decisions. In many cases, technical objections will be overruled for political or business reasons. But this isn’t exclusive to banking. It happens in any industry where technical considerations are often not the primary concern.