For some reason, I've never signed up for web access to my Schwab investment accounts, but I just did today, and I was astonished at one particular security feature. Schwab actually limits your password to 8 characters, and doesn't allow any special characters (#./!, etc.). This is sheer insanity from a security perspective, since you want your passwords to be as long as possible (8 characters is closer to a reasonable minimum length than the maximum), and in addition, you want the character space to be as large as possible, so you want to include as many special characters as possible. Does anyone have the slightest idea why Schwab would do this? The only thing I can think of is to make their password rules as abstruse as possible, to make it unlikely that you'll re-use passwords from another service. Of course, that has its own security risk, since it virtually guarantees that you'll need to write the password down somewhere…
Monday, December 15, 2008
Schwab Password Insanity
Posted by
Ken Smith
at
10:05 AM
Subscribe to:
Comment Feed (RSS)

|