IRD website uses non-case sensitive passwords!?

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › IRD website uses non-case sensitive passwords!?

1 | 2

Peppery

910 posts

Ultimate Geek

Trusted

#1023105 10-Apr-2014 20:43

Lias:
itxtme:
Lias: I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.

I would love to see you hit the IRD login system 5 billion times.......

Always assume that a vulnerability somewhere down the line will see the password DB dumped. It's been done time and time and time again.

Depends on what sort of hashing they're doing. NTLM is pretty easily cracked these days, other algos not so much.

NordVPN

Protect your online activity with NordVPN (affiliate link).

Aaroona

3130 posts

Uber Geek

#1023271 11-Apr-2014 10:17

Peppery:
Lias:
itxtme:
Lias: I don't believe it allows special characters, only alphanumeric (and not case sensitive at that).

10 characters of {a-z,0-9} is 3,656,158,440,062,976 possible, which sounds heaps until you consider that last December a security researched built a 25 GPU cracking rig that could do around 350 billion NTLM attempts per second.. Which would eat that entire range in under 3 hours.. or 6 hours for MD5

Even a decent semi-highend home gaming rig can crank out as many as 5 billion attempts per second. That would chew through that range in a mere 8.5 days..

*EDIT* and that's purely brute forcing the range.. It doesn't even begin to take into account someone with a bit of knowledge and skill applying various "Smart" rules or rainbow tables or what have you to the attempt.

I would love to see you hit the IRD login system 5 billion times.......

Always assume that a vulnerability somewhere down the line will see the password DB dumped. It's been done time and time and time again.

Depends on what sort of hashing they're doing. NTLM is pretty easily cracked these days, other algos not so much.

plus, all it takes for most people these days is a search around the internet to get an idea what they might be using for a password; for some older people I know, they have their favourite pets plastered across their social media pages and I know for a fact that at least one or two of them use their pets names as passwords.

Removing the requirement for case sensitive passwords increases the risk, more so in those cases where someone is being specifically targeted.

Oh and yes, truncating it, again, lessens the security of the password as well.

sleemanj

1474 posts

Uber Geek

#1023930 12-Apr-2014 13:43

Not having case sensitive passwords is fine by me.

It likely saves them a lot of support costs "waaah IRD I can't login", "see that shining light on your keyboard, yeah, that's CAPSLOCK, turn it off".

You know who pays for the IRD support costs, I do! And you. And him over there. But not that guy, parasite.

Obligatory

---
James Sleeman
I sell lots of stuff for electronic enthusiasts...

richms

26394 posts

Uber Geek

Trusted

Subscriber

#1024520 13-Apr-2014 20:20

The number of times people at work have been locked out of things for having caps lock on or else numlock off and trying 3 times and then having to call up and reset has probably cost the bank 100's in call center costs. If there is a lockout for too many incorrect attempts then its not a big deal and would save them support costs.

Richard rich.ms

1 | 2