strange password requirements

[Eric H. Jung]

Hi everyone,

I received an email from Dominic Martin asking this question:

Hi Eric,

How does PasswordMaker handle online bank logins that don't want the complete password, just a few characters from it? The characters requested change everytime that you log in.

[...] my bank does this. ttp://www.firstdirect.co.uk. When you logon to their personal Internet banking, you're asked for two numbers supplied by the bank. They will then ask you for three characters (chosen randomly) out of your password.

It feels like I've come across others but I can't think of anymore for the moment.

Regards,

Dominic

Can anyone think of how I might modify PasswordMaker so password auto-populate works with  sites like these?

Thanks,
Eric

[Miquel 'Fire' Burns]

I can't see a way to do so.

[tanstaafl]

Just so I understand this...

The bank doesn't care *which* three characters - in other words, they aren't asking you to match three characters against a 'picture' composite of the three characters they are asking for, or something like that? Just any three characters?

That's a new one on me...

They probably also don't allow non alpha-numeric characters in their passwords. Most of the online banks are a joke... they implement bizarre login processes like this, but don't allow you to use strong passwords.

Anyway, as to the question...

I think the simplest solution by far is to simply recommend to Dominic to just delete all but three characters after the password has been populated, then click 'Submit'. If the password check really doesn't care which characters, this should work fine - at least, it would be *much* easier than writing code to handle this, but, since you asked...

Sure, I can think of a way to do it, as I'm sure can you - just add an option 'Limit Length of INPUT Password to: ' next to the 'Password Length' field, with a sub-option 'Randomize' - but obviously its not worth the effort, unless this becomes common practice.

[Eric H. Jung]

It's my understanding they ask for 3 very specific characters of the password, and each time it's different. Dominic wrote:

The characters requested change everytime that you log in.

I think they must do something like this. Let's say your password is ILOVEPANCAKES. Each time you login, you probably are presented with something like:

Please fill in the missing characters of your password:
IL*VEP*ANC*AKES

I don't see how PasswordMaker can auto-populate something like this when the missing characters are randomly chosen each time :(

Most of the online banks are a joke.

FWIW, he's in England. Websites of banks in Europe generally have much stronger credential requirements than banks in the US. This has been well documented in trade magazines like InfoWorld et. al. Many banks there use an OTP solution in combination with a user-selected pin/password. The OTP comes from scratch-off tickets (like those scratch-off lottery tickets) the bank mails you for free periodically. Those are cheaper than the RSA fobs which are popular in the US by coporate IT departments.

You can see Dominic's bank must do something like this. He wrote:

you're asked for two numbers supplied by the bank

[tanstaafl]

I think they must do something like this. Let's say your password is ILOVEPANCAKES. Each time you login, you probably are presented with something like:

QUOTE
Please fill in the missing characters of your password:
IL*VEP*ANC*AKES

I don't see how PasswordMaker can auto-populate something like this when the missing characters are randomly chosen each time

Ahh, yeah - but you could at least add the option like I mentioned, so they can *see* their password, and be able to then fill in the missing characters. Definitely not ideal, but at least he'd be able to use it.

The main question is, how much trouble is it, and is it worth it.

[tanstaafl]

Ooops... I forgot, I erased that part of the post... ;)

You could simply add a new Coolkey option, and secondary option next to the Auto-populate option, to 'Display Master Password', so, instead of trying to populate the PW, it simply displays it, so the user cna then fill in the missing characters manually.

Best option I can think of...