1Password:
TD Canada Trust made quite a splash recently when it launched its redesigned iPhone app which disabled pasting in the password field. Users who embrace password managers for their online security were quick to point out their … well, ‘unhappiness’ with this decision. TD Canada’s original response to those users was unsettling.
I had something similar happen to me over the weekend. Canada Post limits passwords to “8 to 12 characters using only numbers and letters”. These institutions need to realize longer, more complicated passwords are better for security.
Regarding the password complexity comment: who’s the developer who’s saying “yeah, sure, that will be fine!”??
I hate it when passwords require a capital letter, a lowercase letter, a number, and a symbol, but limit the passwords to 8-12 characters. Someone teach them about entropy!
In Australia the Westpac iPhone app allows touch ID sign in – best thing they’ve ever done.
I have a a 38 character passphrase with Simple that I never have to use when on the road because they offer TouchID in the app :+1:
What about the password required to open a Password Manager? Is it safe to have a fairly simple password because the app is local to the computer?
This is a sister company of a bank I use. Glad they got vitriol for such poor infosec. That poor social-media intern might not have known what was happening to him/her last week.
I started using 1Password a year ago and slowly migrated all 200+ of my accounts over to unique, long, randomly generated passwords. I’ve been burned several times now by websites whose account creation frontend allows a long password while the backend system includes an unpublished length limit. So an account is successfully created, but I’m unable to access it later—login limbo. It leads to multiple experiments with password resets or sometimes abandoning an account and making an entirely new one.
I used the recommendations here to set my master password:
https://blog.agilebits.com/2011/06/21/toward-better-master-passwords/
http://world.std.com/~reinhold/diceware.html
TD has an amazingly capable website, but the developers are completely off their rocker. Every time they have some new service to advertise, they replace their landing page after signing in.
My grandfather is very nearly blind, so each time they have a new service to push one of us has to go over and figure out how to get past the ad for him so he can pay his bills.
Are you sure you’re never going to sync it to your phone or some other device?
Thanks, very helpful! And yes I would have my app synced so that would expose it somewhat more, I guess.
Can he not use a direct link to log in?
I’ll check, but I don’t think so. This is what appears after you log in. Rather than taking you to the list of actions, it takes you to an advertisement (for their own services) and makes you say you don’t need whatever they’re offering.
Every bank I use doesn’t allow for a really long password. I don’t understand why they don’t allow for unlimited password length. It’s not like they store the password (I hope). And I wish their apps would allow for integration with 1Password. I end up never using my banking apps unless I am close to my iMac so I can read the password while I am entering the app.
BMO Inverstorline (a trading site of Bank of Montreal) only allows passwords up to 6(!) characters long and with no special characters – letters and numbers only. This is completely insane for a site which handles huge amounts of money.
somebody needs to buy them a clue along with TD.
It amazes me that banks and other companies that offer iPhone apps (e.g. airlines) don’t take advantage of the platform and incorporate Apple services like TouchID and common 3rd party services like 1Password into their applications.
It drives me nuts that they don’t consider reducing customer pain while increasing security as primary goals. If they don’t then forward looking companies like Simple will start eating their lunch.
@jonasschoen:disqus You’re right. But the username is changable and that is nearly without constrain 🙂
Please don’t get me wrong but I like PassLocker. 1Password is great app, too.
Maybe you could help him set up a screen sharing application so when this happens, you can remotely help him click through the ad?
I have noticed the “no pasting” thing recently. I will stop using such services and companies that choose to do this craziness. The two-page login security theater is bad enough!
Nick, the IT guy!
You mean in Germany, the country that LOVES long words such as Salthzkammergutlokalbahnlokomoticführerswitwe?
Damn you, Nick, the IT guy!
I was trying to change my password on a website yesterday. They had similar rules, but the symbols that I could (had to) use were limited to about 5-6 different symbols. I had to keep generating a new password in 1Password to find one that fit their rules.
I remember a while back TD Canada Trust wouldn’t let you have a strong password, it was limited to something like 12 character because of the limitations of their software. I expressed concern about how bad that was for security…
Thankfully they have longer passwords now, but still. How does a BANKING COMPANY not have stronger security?
I’d guess that fraud remediation must somehow be cheaper than retrieving strong passwords for forgetful customers.
They’re not going to change anything simply for the sake of security. There will have to be some catastrophic breach that affects their bottom line before they dedicate more resources to security. As long as it works well enough, then “it ain’t broke.”
I’ve thought about it, but he lives close enough that it seems safest to just drive over rather than opening a service someone else might be able to use, too.
“Never use a password you can’t memorize, because otherwise you’ll write it down and that’s insecure!” is … great advice.
From 2005 or so.
A password manager/generator is far, far, far more secure than “something you can remember with a mnemonic” – especially when it’s notionally supposed to be automatically changed every three months.
All that leads to is “the old password with a number on the end”, and that ain’t security, guys.
Perhaps you mean “who’s the manager who made that a requirement because Nobody Will Remember Symbols or longer passwords”?
Backups are encrypted on modern systems, at least.
To echo a comment above, I’m sure it’s not the developers who are insane there.
Dollars to donuts they’re doing that because someone in marketing has authority to force them to.
Worst case hypothesis: They’re not storing the password, but they’re storing a hash as lame as old passwd 56 bit DES – which truncates to 8 characters.
One would hope that a bank wouldn’t be that insane in 2015, though.
On the other hand, I have no idea what their auditing requirements are as an industry – I do know that’d never make it through a PCI/PA-DSS audit.
Also, I don’t know about other banks, but e.g. my credit union … won’t let you actually take any money out of the account via the website without additional authentication.
So someone getting in to my account would … not be able to actually take any of my hard-earned cash, not just with website access.
That strongly limits the appeal to an attacker – why waste time attacking a banking website that you can’t take any money out of?
That sounds like a practice that should be the norm, but isn’t.
Sign in: Username/password5
“Your password has expired.”
Change password to: password6
Oh, sure. But there’s also ethics in software, and sometimes its worth fighting authority.
It might be that they did, and lost anyway. Or they might have never even squeaked. I’d never know. I just know they coded the evil thing. 🙂
I’d say I’m glad to see it’s not only Canadian banks, but schadenfreude isn’t really my thing, and I truly wish all banks would practice proper online security.
Our blog post wasn’t intended only for TD or Canadian banks, so feel free to let your bank know about our open letter as well. Our hope is that as some banks begin moving towards better security practices, more will see the light and join in.
Oh, and yes, I work for AgileBits, the creators of 1Password, as I’m sure is obvious. 🙂
Thanks for sharing our open letter, Shawn. We at AgileBits love The Loop, and we really appreciate you helping spread the word about better password practices.
Yes, as T_Will shared in those links, you want to make sure your password manager’s Master Password is nice and strong. You want all your passwords to be strong, of course, but the Master Password that unlocks your password manager is tricky because you want to make sure you can remember it (it’s the one password you should be able to remember) but also make sure that nobody else can guess it or “brute-force” it.
We at AgileBits are hoping that whoever posted that first tweet at TD didn’t get in any trouble for it since they were likely just replying as they were instructed to. We do feel bad for that person, since he or she almost certainly didn’t know any better. On a plus note, whoever posted that tweet probably knows a lot more about good password practices now than they did before.
Everyone knows I’m a HUGE fan of 1Password and am happy to mention the app and to encourage people to use stronger, better passwords.
It depends on how TD’s management staffs their social-media public face, no? A lot of companies seem to just throw a body and a script at a computer, and do damage-control after foolish gaffes make their way past parts of the company that could have prevented them.
The recent Heartbleed incident gave me an opportunity to test our banks’ and brokerages’ in this regard. I got variable results.
So, thank you for that open letter.
True. My suspicion is that whoever wrote that was following a script, or was at least repeating what they’d been told by a higher up.
Either way, the whole thing has helped spread the word about using strong passwords, and it sounds like some good may be coming out of it with future updates to TD’s app too, so all’s well that ends well.
Some, but not enough. In the end, leaving it up to each individual bank to voluntarily enact better practices means that most of them won’t bother.
This is something that requires regulation, oversight, and penalties for falling short. It’s too important to hope that several dozen CFOs each find Jesus on their own.
Well, all we can do is keep trying to get the message out. Hopefully, if more people are aware, those people will also provide their feedback to the banks and perhaps the banks will get the message. It seems to have worked with TD, so there is hope.
Personally speaking, I can’t argue with that.
TDBank’s software is generally bad. Not just the iPhone app.
A few years ago they acquired a great regional bank (Commerce), which had great service and better fee structure, but once the logos changed, the best stuff gradually phased out. They still suck a bit less than most of the other options I’ve seen out there.
Time to start researching credit unions again, perhaps,