HN Explorer

BMO only uses the first six characters of your password for online banking.

5 points by ptolts ↗ HN
I was just using the BMO iPhone app to check my balance, when I mistyped my password. I had hit the final key too many times, but had already clicked sign in. To my surprise, I was logged in anyway. After testing in a browser I realized BMO only cares about the first six characters of your password.

Astounding.

6 comments

[ 2.0 ms ] story [ 25.6 ms ] thread
ari_elle
Sadly this is more common than you might think and also well known
ptolts
Really eh?

Whats the point in the password strength meter!

ari_elle
Password strength meter not only measures length, but also encourages not to use words and to mix up letters, numbers, special characters and uppercase/lowercase letters.

Not to forget the fact that feeling safe probably is one of the biggest things the strength meter should achieve.

albumedia
Very interesting....at least it's not 4.
ptolts
Yeah! I've unchecked "Save my card number"
Mankhool
I thought that the limit WAS 6 characters from telephone banking days prior to online banking and mobile banking - a holdover. So when I set up online banking eons ago I used the same PW and was setup instantly. I take it new account setups are asking for a longer and more secure PW?