Hanley Economic BS Passwords

kaMelo

I recently opened a Hanley account, mainly to make use of it's DD facility into a savings account as there aren't many of these left. Finally received my user ID through the post and tried to log on but without success. I eventually worked out that the maximum password length you can use in online banking is 12 characters. Unfortunately the sign up process doesn't seem to have such a restriction as the one I used when doing so is 16 characters.

Whatever it is I'm going to have to contact them as I can't log in but my question is, does anyone know whether my assumptions about password length are correct?

masonic

Yes, the limit is 12 characters. When I signed up in early 2024 I was given a default 8 character password, and I was restricted to 12 when I changed it.

flaneurs_lobster

https://forums.moneysavingexpert.com/discussion/comment/81960456#Comment_81960456

Yes, 12. Checking my password it also looks like it does not allow special characters.

Not the first time I've come across this problem, a large well-known insurance company allowed a password to be set up that was invalid for subsequent logins.

masonic

I also had something similar with Coop, which apparently has truncated the password I had chosen. It accepts the shorter version.

Georgemc

Password length restrictions is a MASSIVE red flag for a financial institution. If they're hashing it correctly in their database it matters not one bit to them how long it is. Bcrypt - the hashing they should be using - will always give the same length of output regardless of how long the input. Them caring about password length tells me they're storing it in plaintext.

kaMelo

Thanks to all for your replies which confirmed my assumptions. The lady I spoke too at Hanley didn't know too much about the length of passwords allowed but she sorted the login problem for me in less than five minutes. Reset the account and sent me a temporary password, even waited on the phone to ensure I could log in.

Top customer service from Hanley Economic BS.

Rudyson

Mine has 15 characters. What I did find weird is that you seem to need more than one character in each category, upper case, lower case etc

mon3ysav3r

I had similar issues, I first set a 17 character password, then changed it to a 12 character password.

12 characters is rather short for a password, and the lack of any special characters makes it even weaker.

Lots of IT red flags here, especially around testing!