ETrade password security, or lack of

etrade babyEvery week we read about different security breaches, like this week’s one where Russian hackers have amassed over a billion passwords.

A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.

Thinking that it was time to change some passwords on various accounts that I use, I discovered something that I find quite alarming.

ETrade’s password policy, or lack of.

They only allow letters and numbers.

They don’t allow punctuation.

They don’t allow special characters.

They don’t recognize the difference between uppercase and lowercase characters.

ETrade password policy

The SANS Institute’s recommendation for a strong password is the following:

Contain at least three of the five following character classes:

    Lower case characters
    Upper case characters
    Numbers
    Punctuation
    “Special” characters (e.g. @#$%^&*()_+|~-=\`{}[]:”;’<>/ etc)

ETrade only allows three of the five, and really only checks for two. If your password is “PasSworD123”, ETrade will accept “password123”.

ETrade’s response to this is to use the free two-factor authentication that they offer. While this is indeed helpful, I feel that it’s rather misleading and a bit deceitful to not alert their customers that their password really isn’t as secure as one might believe. Nowhere do they mention that your password isn’t checked for case sensitivity.

They should also do a much better job of promoting the two-factor authentication. The main login screen doesn’t mention it at all.

ETrade isn’t the only company with a poor password policy. Charles Schwab secretly truncates passwords down to 8 characters and also doesn’t care if your entered password is case accurate.

For now your best choice is to use the free two-factor authentication. Beware though that you can easily enable this with ETrade and they don’t really give you ANY instructions on how to use it. It’s not hard but it’s different and not intuitive.

Share

Leave a Reply

Your email address will not be published. Required fields are marked *