IRD website uses non-case sensitive passwords!?

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › IRD website uses non-case sensitive passwords!?

Aaroona

3196 posts

Uber Geek

#143304 9-Apr-2014 21:02

I was logging in tonight and forgot to press shift, turns out, it accepted the password anyway.

Is it common for sites to do this? sounds like pretty piss poor security practices if you ask me...

1 | 2

4431 posts

Uber Geek
Inactive user

#1022475 9-Apr-2014 21:09

Just checked then... pathetic!

JarrodM

969 posts

Ultimate Geek

#1022483 9-Apr-2014 21:19

just checked mine aswell. and yip, can log in without capitals too. pretty poor.

chevrolux

4962 posts

Uber Geek
Inactive user

#1022493 9-Apr-2014 21:35

lol......

Is this the new billion dollar system? Or not quite yet?

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#1022495 9-Apr-2014 21:36

Well, most banks are case insensitive for their online banking too, so... yes.

blakamin

4431 posts

Uber Geek
Inactive user

#1022499 9-Apr-2014 21:44

Kyanar: Well, most banks are case insensitive for their online banking too, so... yes.

But banks only have your money... look at all the details IRD have.

(my bank is case sensitive)

Zeon

3916 posts

Uber Geek

Trusted

#1022501 9-Apr-2014 21:56

I for one look forward to my tax being paid by a hacker :)

Speedtest 2019-10-14

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#1022590 10-Apr-2014 07:45

Good news, though. RealMe is case sensitive. Which raises the question, why does the IRD not use it?

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

BTR

1527 posts

Uber Geek

#1022591 10-Apr-2014 07:56

Government department, they probably thought not checking the case sensitive box saved them some money haha.

SteveON

1916 posts

Uber Geek

#1022595 10-Apr-2014 08:12

I'll have a chat to one of their guys. Hopefully they know.

Lias

5589 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1022728 10-Apr-2014 11:54

IRD's system also (or at least did) truncates passwords to 10 or 12 characters (I forget exactly, but it was several characters shorter than the 16 digit password I was trying to use at the time)

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup.

itxtme

2102 posts

Uber Geek

#1022810 10-Apr-2014 12:57

So the password possibilities based on between 6-10 characters is

511,116,753,300,641,400

or

Five hundred eleven quadrillion, one hundred sixteen trillion, seven hundred fifty-three billion, three hundred million, six hundred forty-one thousand, four hundred

Granted that is less than the

19,921,814,720,464,100,000

Nineteen quintillion, nine hundred twenty-one quadrillion, eight hundred fourteen trillion, seven hundred twenty billion, four hundred sixty-four million, one hundred thousand,

I think some of you are getting a little silly

Lias

5589 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1022869 10-Apr-2014 13:58

I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.

itxtme

2102 posts

Uber Geek

#1023020 10-Apr-2014 17:15

Lias: I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.

I would love to see you hit the IRD login system 5 billion times.......

blakamin

4431 posts

Uber Geek
Inactive user

#1023044 10-Apr-2014 18:33

If they can't have case sensitive passwords, I doubt they'd even notice.

Lias

5589 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1023063 10-Apr-2014 19:24

itxtme:
Lias: I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.

I would love to see you hit the IRD login system 5 billion times.......

Always assume that a vulnerability somewhere down the line will see the password DB dumped. It's been done time and time and time again.

1 | 2