为什么银行密码如此脆弱？
出于兴趣并且因为这激怒了我，我想知道这里的某个人是否碰巧在银行工作或以其他方式知道这个问题的答案。
我使用过一些在线银行网站（英国和英国） .America）并且他们普遍强制使用 /[\w\d]{6,8}/ 的密码模式。有时，也许你可以使用下划线，但你永远不会使用 /.{6,20}/，您在几乎所有遇到的！银行网站上都会（或多或少）获得这些信息。
有人告诉我这与存储空间有关，但数学似乎并不支持这一点。 假设银行为您的密码记录保留影子表，让我们慷慨地说每个帐户平均有 10 个，然后将密码允许的长度加倍，并将基于 8char 8bit 现有格式的字符集位宽加倍意味着 每个帐户额外 11*2*8 = 176 字节，因此每 1M 帐户约 168Mb。 假设这是一家支持 100M 账户的大型银行 - 但仍然只有 16Gb！
事情不可能这么简单吧？ 当然，我的数字有误。
或者这里的答案是，银行就是银行，他们没有更好的理由，就像他们是缓慢的恐龙一样。
有谁知道为什么我的 www.random.com/forum 密码比我的银行密码强的技术原因？
Out of interest and because it infuriates me, I was wondering if SOmebody here might happen to work for a bank or otherwise know the answer to this.
I've used a few online banking sites (UK and N.America) and they universally enforce a password pattern of /[\w\d]{6,8}/ Sometimes, maybe you get to use underscore, but never ever do you get to have /.{6,20}/ that you get (more or less) with just about every !banking site you'll encounter.
I have been told that this is to do with storage space, but the maths don't seem to support that. Assuming that banks keep shadow tables for your password record, let's generously say an average of 10 per account, then doubling the allowed length of the password and doubling the bit width of the character set based on an 8char 8bit existing format means an extra 11*2*8 = 176 bytes per account, so ~168Mb per 1M accounts. Let's say it's a gigantic bank supporting 100M accounts - that's still only 16Gb!
It can't be that simple can it? Surely my numbers are off base.
Or is the answer here that banks being banks they have no better reason for this than they're plodding dinosaurs.
Does anyone know a technical reason why my password for www.random.com/forum is stronger than the one for my bank?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
如果我听到的关于某些银行的故事是真的……
那是因为每当您输入密码时：
因此，您的密码只能使用所有这些系统支持的字符集的公共子集，并且只能与所涉及的最短数据库字段一样长。
If the stories I've heard about certain banks are true...
It's because whenever you enter your password:
So your password can only use the common subset of the character sets supported by all these systems, and can only be as long as the shortest database field involved.
事实上，我现在在一家银行工作，过去也曾在多家银行工作过。
发生这种情况的主要原因是，一般来说，最终负责制定这些决策的人并不是最终执行这些决策的人。
银行的“业务部门”是最终做出这些决策的非技术业务专家。
在许多情况下，技术异议会因政治或商业原因而被驳回。 但这并不是银行业独有的。 这种情况发生在任何技术考虑因素通常不是主要关注点的行业。
I actually work in a bank right now, and have worked in quite a few in the past.
The primary reason that this happens is that in general the people who are ultimately responsible for making these decisions are not the people who end up implementing them.
The "Business Unit" of a bank are the non-technical business experts who end up making these decisions.
In many cases, technical objections will be overruled for political or business reasons. But this isn't exclusive to banking. It happens in any industry where technical considerations are often not the primary concern.
银行主要使用在线服务作为旧系统的接口。 您的密码可能正在由某处的 IBM 大型机处理，用 Cobol 编写，并且密码结构可能是在 70 年代设计的。
另外，由于银行是这样的政治结构，管理层主要看到的是“具体”结果，因此安全等问题只有在成为热点问题后才会有“举措”来解决。
在我工作过的一家银行，生产密码与用户 ID 相同（与使用“root”“root”登录的想法相同）。 用户密码可以在线重置为您姓氏的前 N 个字母 + 您的 SSN 的后 4 位数字的组合，因此任何用户如果知道您的姓名和 SSN 并以您的身份登录，都可以重置您的密码。
Banks use online services primarily as an interface to legacy systems. Your password is probably being processed by an IBM mainframe somewhere, written in Cobol, and the password structure may have been designed in the 70's.
In addition, because banks are such political structures, the management primarily sees "concrete" results so issues such as security are not addressed until it becomes a hot issue and then there is an "initiative" to address it.
At one bank I worked for, the production password was the same as the userid (same idea as logging in with "root" "root"). The user passwords could be reset online to a combination of first N letters of your last name + last 4 digits of your SSN, so any user could reset your password if they knew your name and SSN and loginas you .
可能大多数银行系统都是很久以前开发的，当时 8 个字符的密码被认为是安全的。 无论如何，我认为没有人会考虑从银行帐户中暴力破解密码，8 个字符仍然很多。 我敢打赌，所有银行都会在尝试 3 次左右后冻结账户。
Probably most of banking systems were developed long time ago, when 8 character passwords were considered secured. I don't think anyone would consider brute forcing passwords from banking accounts anyway, 8 characters it still a lot. I bet all banks block an account after 3 attempts or so.
这是我在 Bugzilla 中记录的一个“错误”，涉及我最近为客户（不是银行，谢天谢地！）构建的一个网站：
Here is a "bug" I got logged in Bugzilla regarding a site I'd built for a client recently (not a bank, thankfully!):