Open a bug report

Literally this

Just wait until you get to Transunion's site. It is a dumpster fire of consisting of the worst sign up I've ever seen, "Contact our social team" and "If you haven't logged in for awhile create a new account. I could not believe how awful it was. I had to just call and do it over the phone.

My bank used to not let me type one longer than six (6) characters!

Fuck1ngKil!M3

I'm just gonna go ahead and say it: 16 Characters are sufficient and 20 pretty damn secure.

That is assuming they do stuff right and there are no vulnerabilities, which they won't and there are. However they may manifest, they are a greater concern at 16+ characters, especially if they don't offer 2FA.

The reason is that even if machines become powerful enough that 16 characters can be bruteforced, which they can't atm, you can effectively defend everything against bruteforce attacks by other means. Including but not limited to limiting login attempts, salts and pepper, multiple encryption layers etc.

With just ~~a salt~~ pepper you can make a 16 char password effectively a 24 char password... Or a 2.000.000 char password. Assuming it is not stolen alongside that is.

Edit: Changed 'salt' to 'pepper'.

This implies they're storing the plaintext password.

Ideally the password would be hashed with a salt and then stored. Then it's a fixed length field and it shouldn't matter how long the password is.

I went through that bullshit so many times trying to get the characters etc then the next step said not available try again later, then repeat that a few times. What BS a max of 20 characters is too.

Oh boy. If you think this is bad, you should try waiting a few weeks or months after you're signed up this time, then sign up for a new account using your current details, just with a different email. Spoiler: if you can answer the security questions, you're home free.

And remember that between the Equifax leak and more recent hacks, at this point, every sensitive detail for every member of the economy is now in the hands of bad actors. If they want your shit, or into it, they'll social engineer it.

Should passwords have maximum character counts? Sure, to prevent overflow attacks (or whatever) by pasting five different analyses of the movie Primer as your password. It should be longer than 20 in any case. But are there other, way worse security issues? Yes.

I also like that the only type of MFA that all 3 agencies implement is text/phone call. Cause likes there's nonway someone could spoof a phone number and then unfreeze your credit.

the Ring app (I think) forced me to change my Wi-Fi password because I wasn't allowed to use ampersands. according to support it's because they "use ampersands in the code"

Reminds me of this

that is a painfully bad list of ~~requirements~~ bullshit

That’s security theater for you…

I'd like to not solve a boolean satisfiability problem along the way, please.

@nokturne213 Add it to https://dumbpasswordrules.com/

#DumbPasswordRules

Credit bureaus are not for your protection, they're for the protection of their clients, the banks.

Financial institution security is quite frankly a freaking joke. My bank only has the options for 11 character passwords at maximum. It's like oh come on that is way too easy these days

Yeah well, if you’re so smart let’s see you write a website in COBOL.