I just completed an order with Newegg for some personal computing equipment. That part was OK. What wasn't OK was the "Verified by Visa" thingy that popped up during the ordering process. My primary credit cards aren't Visa so I haven't seen that yet, despite shopping on sites with the verified by Visa logo on 'em. Since I hadn't used it before I had to set the durned thing up. Which meant picking a password.
My jaw dropped.
6-8 characters is stated in the 'password policy' that was posted. And no matter what I threw at it, if I used my shift key it wouldn't take the password. I don't know about you, but complex password policies have been around long enough that my fingers automatically go for the shift key when entering passwords. NOT using it took mental effort. In fact, the password I ended up with is markedly less secure than the one I use for throw-away accounts on web-sites I don't care about.
That is not a way to run a bank.
I don't know what "Verified by Visa" really provides, but whatever it is, password security isn't it.
My jaw dropped.
6-8 characters is stated in the 'password policy' that was posted. And no matter what I threw at it, if I used my shift key it wouldn't take the password. I don't know about you, but complex password policies have been around long enough that my fingers automatically go for the shift key when entering passwords. NOT using it took mental effort. In fact, the password I ended up with is markedly less secure than the one I use for throw-away accounts on web-sites I don't care about.
That is not a way to run a bank.
I don't know what "Verified by Visa" really provides, but whatever it is, password security isn't it.
You might find this article and paper interesting about what VbV does, and more importantly doesn't, do.
http://www.lightbluetouchpaper.org/2010/01/26/how-online-card-security-fails/
I was also concerned about Verified by Visa.
I have accounts with two Canadian banks - one allows any password length longer than 4 digits with special characters. The other has to be between 6 and 9 characters with no dashes or special characters. Numbers and capitals are allowed.
@chris Sounds like it's the subscribing card issuer that sets the password policy. If that's the case, who I yell at needs to change. That said, this particular issuer's online banking presence has a rational password policy, I don't know why they'd use such a vastly different password policy for Verified-by-Visa charges.