American Express
Yes. The very same company that brought you the unlimited "Black" card (properly known as the "Centurion Card") has one of the WORST password requirements I've ever seen. My AIM password is more complex that their system allows!!! If you are wondering exactly what their policy is, here you go (Direct from their Registration Page):
Your Password should contain 6 to 8 characters . at least one letter and one number (not case sensitive), contain no spaces or special characters (e.g. &, >, *, $, @) and be different from your User ID.
You read that correctly, they allow a max password length of 8 characters. Its case insensitive. Oh, and you can't use special characters. ... I'm sorry... WHAT THE F***?!!?!?! This is a financial website!!! This is a big company!! They should know freaking better!! MY USERNAME IS LONGER THAN MY PASSWORD!! There are huge concerns about phising on the internet, and brute forcing an 8 character password is cake for computers these days. This password limit is arbitrary and asinine at best.
Ok... Calming down here. I really am a big fan of internet banking. I love being able to do everything online. I just signed up for American Express, and I'm already tempted to cancel my account simply due to this password policy. Compared to every other financial website I use, American Express is just depressing. Many financial companies websites go as far as making you register your computer (annoying, but it is more secure). Some you have to enter multiple pieces of secure information. Am Ex? 8 Characters, tops. I'm not asking for them alot. In fact, if anyone from American Express reads this, this is exactly what I want:
- You need to increase the max length to at least 18 characters.
- You need to make the alpha text case sensitive.
- You need to allow for symbols.
Update (2007-09-28 @ 11:10) I actually wrote American Express customer service last night and asked them about this. They sent me back a nice canned response. Its about a page long, but here is the "important part":
Please be advised that American Express monitors all accounts to detect suspicious activity and we do not hold our Cardmembers liable for any unauthorized charges.
If you suspect that you have unauthorized charges on your statement, please contact us at the number on the back of your Card as soon as possible (24 hours/7 days). If you are outside of the United States, please call us collect at 1-336-393-1111. For a list of phone numbers, please visit
So there you go. American Express apparently believes more in their background monitoring than the need for passwords. Ok, Fine. I still wish I could use some of my regular passwords though.
Update (2007-09-28 @ 12:05) This article made top 10 at Digg. What the Duce?!
it was the password that needs to be casesensitive and stuff ...
guess i was wrong ...
but for a lay guy like me ...
an 18 character username or password is an overkill ...
but you may be right ...
better to be safe than sorry ... especially when you say its a piece of cake to brute force your way in ...
You wrote:
> brute forcing an 8 character password is
> cake for computers these days
Sometimes. If you give the computer the encrypted password (the "right answer") and let it crank, yes, it is easy.
But American Express is probably rate limiting attempts. They are limiting the number of attempts per account, or per attempting IP address, or both. A slow enough rate can make a relatively small password space quite secure. ATMs do the same thing. Too many bad tries and they seize the card, right?
That doesn't mean they couldn't do better, and that doesn't mean that if an encrypted or hashed copy of the passwords leaked out they wouldn't be easy to hack. It just means that they aren't as open as you make it sound.
-kb
Even still. Its a ridiculous requirement.
If they can rate limit attempts, it *is* secure. Not "kinda", but "is". However, the "if" part is key.
Say they rate limit to 1 try every two seconds.
To brute force a random 8 character alphanumeric password with 50% probability would take over 90,000 years.
That is pretty damn secure. And they are not going to leave the account open that that much probing. They probably permanently lockout a password after a few handfuls of attempts. Actually, they are probably annoying and kill the password after a very small number of attempts. I have had passwords die after only three attempts.
BUT, the "is" secure assumes that the brute force rate really is limited. If something goes wrong and the Bad Guys get a copy of a backup tape...the security collapses.
Like an ATM PIN, AmEx is counting the Bad Guys never getting a copy of the password file.
Still, better than an ATM PIN: I have a bank account that used to have a 6-digit PIN, but they reduced it to 4. Maybe being that secure was not compatible with the rest of the banking world.
Thanks for pointing out AmEx's silliness,
-kb
Its all about the illusion of security.
Officially, its poor practice to use a single password everywhere. I'm guilty of that myself, from time to time (too many junk websites). But when I can't even use anything remotely similar to my standard password affair... I'm lost.
Biggest security hole: Typing passwords on keyboards that are bugged. Maybe because the computer at the internet cafe has a keylogger on it. More likely because you are using Windows at home and some spyware is reporting back.
I use Linux. I am conservative about what I install. I don't browse the web or read e-mail as root (administrator), so I trust this keyboard and I don't type passwords on other keyboards. I have a small notebook computer, I carry my notebook with me and use it.
-kb
And even if they do limit your tries, a hacker could set up bots on unknowing computers using a virus, worm, or trojan house. Those bots could all try passwords on the website until one worked, then transmit the password that works back to the evil hacker. That type of parallel brute force would work much faster with an 8 character password limit than if the website had a password limit longer than 8 characters.
In reality, the only reason I got one was for use at Costco.
To be fair, when I signed up for AMEX 2 years ago I found the 8 character password limit ridiculous. I use password safe and like to keep my passwords between 12 - 20 characters of random gobbley gook. Instead of calling AmEx (which you proved is pointless) I made my USERNAME a bunch of gobbleygook...
I do use KeePass to keep my passwords. Even still, I'd prefer it if I didn't have to obfuscate my username because their password policy sucks.
Not to mention their UI for your bill and points absolutely sucks ass! I mean, seriously...it REALLY sucks.
How can you have a UI for a credit card that doesn't easily show you all the latest transactions in a nice, easy-to-understand way? i.e. what payments were made, what charges were made.
That too much to ask?
I can't really complain too much though, I've seen worse UI's, and I've seen better. I'm sure whom ever designed it, thought it was cool, made sense, and was useful.
I'd rather a site that warns you that only eight characters apply, but lets you input more and just truncates.
If you have a pswd system...
Do:
Use upper case
Use lower case
Use numbers
Don't use special symbols -- some sites can't handle them.
Don't start with a number -- some sites require a letter first
Anyway, if anyone reading this has not heard of Security Now! podcast, I recommend that you check it out (Google is your friend). They have quite a few podcasts on password security. It's my favorite tech podcast.
So typically an attacker would choose a common password... say "password1" then use that password whilst randomly trying different username combinations (i.e brute force the username rather than the password). That way the rate limit by username would not stop him... but of course the rate limit by IP would.
Remember they've got millions of customers, including your aunt mildred who spends 2 hours with MSN every week because she forgets her hotmail account, and has all the time in the world to talk to customer service.
I guess, however, that an attack would have to come from multiple IP addresses -- and even at that, hopefully, their server would have the sense to lock the account. If so, I guess it's safe. But I do hate that it won't let me use my system (which is 10 characters) and then just truncate. I have too many logins to keep track of the maverick sites.
With symbols, all my passwords are unique and at least 15 characters in length. When a site is retarded and only accepts letters and numbers, I up it to 20.
When I found out about the 8 character American Express password limit; I cried. Seriously: this type of data requires my BEST password scheme, and they're making me use a password that's worse than my don't-give-a-shit spam email account's password. Sheesh.
I still am pissed about their lack of concern over this matter. This is the only site I've come across that deals with financial matters where passwords are NOT case sensitive.
Seriously, why is my email more secure that my money?