New offer 3.7% | Page 2 | Tangerine Bank | Discussion forum

BK said
Tangerine now requires 12 character passwords.  

Is that only for new customers?

COIN said

Is that only for new customers?  

No, it has been an option in the settings menue for several months, just that they are randomly notifying clients to create a new 12 character password. There's nothing to stop any other client that has yet to be notified from changing to it now. For those clients, it's optional until it isn't.

This one hasn't made it to the promo page yet (for any admin who might see this).

BK said
Tangerine now requires 12 character passwords.  

It's not the size of the password, it's how you use it.

By requiring larger and more complex passwords, most peoples accounts will actually be less secure, but this, 2FA etc etc are all more effective ways to protect their bottom line by avoiding paying the cost to have proper and secure infrastructure, while at the same time putting the blame on the user for not having a good password or for not keeping their information secure. It's win win for the business.

mr P. Pincer said

I was referring to the topic of this thread. An admin has added this new promo to the promo page now 🙂 Thanks!  

Hmm, seems Tangerine is very selective on whom they'll target these days, in other words, hardly anyone wins the lottery anymore.

JohnnyCash said

Hmm, seems Tangerine is very selective on whom they'll target these days, in other words, hardly anyone wins the lottery anymore.  

I haven't seen an offer (except maybe one) from Tang (and Simplii) since forever.

RetirEd said
mordko: Shorter or simpler passwords cannot be decrypted since there no encrypted password for a cracker to work on. They can be more easily "brute-forced," though, by trying all possible configurations. But long before even a simple password can be found that way, one would hope the banking systems would notice the massive number of tries. Many will stop at 3 to 5 tries and say call the bank to unlock the freeze.

I NEVER got an offer from Tangerine while a client. When I called in and begged, they'd either offer half what others would get, even then sometimes wanting a promise I'd keep a lot of cash in there - $85K on the last occasion.  

At 1B guesses/sec a lower case 6 character password takes 0.3 seconds to “crack” at most. Leaked credentials can be deciphered on offline machines without alerting the bank.

RetirEd said
mordko:

Leaked credentials can be deciphered on offline machines without alerting the bank.

Huh? Sure, those billions of combinations can be run through quickly, but the computers responding to them are just as fast! And how does one know if one has found the password "on offline machines" without having the bank's machines respond?

More and more systems are being configured to stop after a few trials, or increase the response delays with each trial. My home computer, running Linux, is configured to take longer and longer with each wrong password.  

In most cases, cracking the password is one thing, figuring out the username that goes with it is another.

The one thing I found odd, I never recall over the years having seen any threads, or posts about actual compromised Tangerine 6 digit pins that lead to account access being gained, ever!