Privacy

32120 readers

329 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

610

Signed up for Equifax to freeze my credit, password can not be longer than 20 characters (i.imgur.com)

submitted 3 months ago* (last edited 3 months ago) by nokturne213@sopuli.xyz to c/privacy@lemmy.ml

147 comments fedilink hide all child comments

Not only does the credit bureau max out their password length, you have a small list of available non-alphanumeric characters you can use, and no spaces. Also you cannot used a plused email address, and it had an issue with my self hosted email alias, forcing me to use my gmail address.

Both Experian and transunion had no password length limitations, nor did they require my username be my email address.

Update: I have been unable to log into my account for the last 3 days now. Every time I try I get a page saying to call customer service. After a total of 2 hours on hold I finally found the issue, you cannot connect to Equifax using a VPN. In addition there is no option for 2FA (not even email or sms) and they will hang up on you if you push the issue of their security being lax. Their reasoning for lax security and no vpn usage is "well all of our other customers are okay with this".

(page 3) 50 comments

sorted by: hot top controversial new old

[–] normplum@fosstodon.org 3 points 3 months ago

@nokturne213 Add it to https://dumbpasswordrules.com/

#DumbPasswordRules

[–] UnbalancedFox@lemmy.ca 1 points 3 months ago (1 children)

I had an account there with a proton email address and suddenly I couldn't log in anymore. After 6 months of calling, someone finally told me proton emails are blocked because they are not secure. So I changes it to a tutanota email

What a clusterf**k

[–] nokturne213@sopuli.xyz 2 points 3 months ago

I almost used my proton mail because I can create an alias, where equifax would not accept a plused gmail account.

[–] iamam@lemm.ee -1 points 3 months ago

[–] UnfortunateShort@lemmy.world -2 points 3 months ago* (last edited 3 months ago) (10 children)

I'm just gonna go ahead and say it: 16 Characters are sufficient and 20 pretty damn secure.

That is assuming they do stuff right and there are no vulnerabilities, which they won't and there are. However they may manifest, they are a greater concern at 16+ characters, especially if they don't offer 2FA.

The reason is that even if machines become powerful enough that 16 characters can be bruteforced, which they can't atm, you can effectively defend everything against bruteforce attacks by other means. Including but not limited to limiting login attempts, salts and pepper, multiple encryption layers etc.

With just ~~a salt~~ pepper you can make a 16 char password effectively a 24 char password... Or a 2.000.000 char password. Assuming it is not stolen alongside that is.

Edit: Changed 'salt' to 'pepper'.

load more comments (10 replies)

load more comments