Not only does the credit bureau max out their password length, you have a small list of available non-alphanumeric characters you can use, and no spaces. Also you cannot used a plused email address, and it had an issue with my self hosted email alias, forcing me to use my gmail address.

Both Experian and transunion had no password length limitations, nor did they require my username be my email address.

Update: I have been unable to log into my account for the last 3 days now. Every time I try I get a page saying to call customer service. After a total of 2 hours on hold I finally found the issue, you cannot connect to Equifax using a VPN. In addition there is no option for 2FA (not even email or sms) and they will hang up on you if you push the issue of their security being lax. Their reasoning for lax security and no vpn usage is “well all of our other customers are okay with this”.

  • krolden@lemmy.ml
    514·
    3 months ago

    Super long passwords aren’t going to do you any good when their database is compromised and sold to anyone with a few bucks.

    Its not like some one is gonna be brute forcing your account password, it would lock your account after like ten tries.

    • refalo@programming.dev
      1·
      3 months ago

      sounds like a great way to DoS people’s accounts, especially if you don’t want them to be able to see what you’re doing

    • Hirom@beehaw.org
      15·
      3 months ago

      Quite the contrary.

      Password hashing is standard nowadays.

      When a database is compromised, brute forcing hashes is necessary to recover passwords, and the short ones are the first ones to be recovered.

      • krolden@lemmy.ml
        11·
        3 months ago

        So what? They’ll get your single use randomly generated password months/years/decades after you’ve already changed it?

        • The Doctor@beehaw.orgEnglish
          1·
          3 months ago

          Which begs the question, how often do people really change their passwords unless they’re forced to? This feels like the sort of thing that somebody should have studied.

          • krolden@lemmy.ml
            2·
            3 months ago

            If its not been pwned then why bother? As long as you’re using a password generator and only using per a service passwords plus MFA youll be fine

  • StorageAware@lemmings.worldEnglish
    6·
    3 months ago

    I always get a chuckle when financial institutions have requirements like these, or lack 2FA. My Lemmy account has more security at this point.

  • alkaliv2@lemmy.world
    18·
    3 months ago

    Just wait until you get to Transunion’s site. It is a dumpster fire of consisting of the worst sign up I’ve ever seen, “Contact our social team” and "If you haven’t logged in for awhile create a new account. I could not believe how awful it was. I had to just call and do it over the phone.

    • nocturne@sopuli.xyzOP
      3·
      3 months ago

      Transunion was not too bad, and they did not require my full SSN, unlike Equifax. But transunion will not easily give me my credit score unlike the two Es.

  • voracitude@lemmy.world
    11·
    3 months ago

    Oh boy. If you think this is bad, you should try waiting a few weeks or months after you’re signed up this time, then sign up for a new account using your current details, just with a different email. Spoiler: if you can answer the security questions, you’re home free.

    And remember that between the Equifax leak and more recent hacks, at this point, every sensitive detail for every member of the economy is now in the hands of bad actors. If they want your shit, or into it, they’ll social engineer it.

    Should passwords have maximum character counts? Sure, to prevent overflow attacks (or whatever) by pasting five different analyses of the movie Primer as your password. It should be longer than 20 in any case. But are there other, way worse security issues? Yes.

    • toastal@lemmy.ml
      20·
      3 months ago

      My bank disables paste as has code checking if the browser is greater than Netscape Navigator 4.

        • toastal@lemmy.ml
          1·
          3 months ago

          I wrote a TamperMonkey script. 😅 I needed to so I could use my password manager. How dare I.

          Should be a general web dev usability note: always aim to make your code to be friendly for scraping & userStyles/userScripts. If a client isn’t updating shit, at least users can easily fix things. This is also another point against this Tailwind-only trend since you tend to lose anything semantic in the DOM & have nothing to select on.

    • otp@sh.itjust.works
      8·
      3 months ago

      Yup. My bank was even “translating” passwords to PINs behind the scene specifically so your password for the website would be the same as your password on the telephone.

  • Asafum@feddit.nl
    13·
    3 months ago

    I happened to freeze all my credit in the same weekend I switched car insurance so I don’t know who is to blame (my bet is on GEICO) but starting Monday I’ve been getting a bunch of spam calls and texts…

    Such scumbags… If it’s the credit agencies they caused the problem for me to be there and are now profiting off the “solution” and if it’s GEICO it’s probably worse since I’m already fucking paying them, but no they need more.

    • Trainguyrom@reddthat.comEnglish
      3·
      3 months ago

      Just a quick tip: I’ve had good luck getting insurance through a broker. I have cheaper insurance through some B2B place that doesn’t work directly with consumers with better coverage than if I went through some national brand that spends millions of dollars a month on advertising to consumers. The other benefit of a broker is now you have a third party who’s incentivized to not only find you the best deal but also someone you can get advice from during a claim should anything seem off to you.

  • chiliedogg@lemmy.world
    17·
    3 months ago

    I swear password restrictions are getting to the point where there’s eventually going to only be one usable password.

    • filcuk@lemmy.zip
      8·
      3 months ago

      Yeah, it’s counterproductive to lay out a bunch of restrictions. Let people make a long-ass password that’s a memorable phrase - it’s safer anyway.

      Although I don’t know how anyone makes it without a password manager at this point.

      • sylver_dragon@lemmy.worldEnglish
        8·
        3 months ago

        I don’t know how anyone makes it without a password manager at this point.

        Password reuse. Password reuse everywhere.

          • nocturne@sopuli.xyzOP
            3·
            3 months ago

            When I have to sign up for something on my phone I will use my pre Bitwarden default password. Then once I have a sec to sit down iPad or laptop I will change it to something more secure.

            I am currently fighting with my wife and children to start using a password manager.

              • nocturne@sopuli.xyzOP
                2·
                2 months ago

                I have only used lastpass (they have had several breeches and I do not recommend them), Bitwarden (my current daily driver and my recommendation), and I have used Apple keychain a little for passwords at work that my wife can access without having full access to my Bitwarden.

            • filcuk@lemmy.zip
              3·
              3 months ago

              On your phone, you can select autofill, then ask bitwarden to generate a password, save and use that to register

            • Dizzy Devil Ducky@lemm.eeEnglish
              5·
              3 months ago

              The funny thing about that is that I am currently on my laptop getting keepassxc set up. This post has somehow motivated me to finally get a password manager.