Tattersall's gamble with password security

By David M Williams
Wednesday, 24 June 2009 07:09

Technology

According to Hitachi’s best practices for password management a password of eight characters that only permits one case as well as numbers has 2.82e12 combinations (that’s 2,820,000,000,000.) By contrast, if both cases are permitted the number of combinations increases substantially to 2.8e14 (or 280,000,000,000,000.)

These are awfully large numbers of combinations either way. However, consider that the vast bulk of these combinations are meaningless jumbles of letters and numbers. In practice, many people will opt to use a real word or name and potentially only one or two letters at the end of the word. This diminishes the number of combinations dramatically.

Most institutions recommend passwords contain a mixture of upper- and lower- case letters.

I personally verified that Tattersall’s did not distinguish between case. I created an account on their site with a password of SMITH123 and was able to successfully log in using password smith123.

I phoned Tattersall’s using the telephone number provided to Jeff Wharton to call if he had further enquiries. I asked if there was a reason Tattersall’s did not make this distinction.

The person I spoke with was unaware that the web site allowed people to log in using any case variation on their password. I explained the problem and referred to the Complaints and Incidents Officer who had responded to Wharton.

I disclosed I was a journalist and the headline of this story.

The officer simply advised me that if Tattersall’s knew about this handling of upper- and lower- case characters then they must be satisfied and happy with it.

A call has been made to Tattersall's public relations for an official comment and will be added here as soon as it is received.