Jul
21
Memo #10 – How not to design for security
Filed Under Annoyances | 4 Comments
Just a quick memo on how not to design for a secure computing environment. I got the following message when logging into my commercial banking website.
Password Guidelines
Passwords must:
- Be six to twelve characters
- Contain at least one number
- Contain at least one letter
- Not be identical to your first name, last name, company name, company ID, user ID, or your previous six passwords
- Not use the names of the months (example: march123)
- Not repeat the same character three or more consecutive times (example: 2kaaa3, 0000abe49)
They also make you change your password every 60 days. Do you know what this results in? Me writing down my password on a piece of paper next to my desk. Seriously. That’s how stupid it is. Oh, did I mention that if you fail your login three times they will lock-out your account?
Needless to say, this is not how you should be developing secure web applications.