I’m lucky my banking app works (GrapheneOS), as it’s now requiring 2FA with the app anytime I login on the browser. Can’t use an actually secure form like TOTP. At least they now allow passwords over 8 characters (yes, serious).
My bank is like that and another horrible thing is that after you choose your password (which can be long and complex) you need to choose a 6 DIGIT restore code incase you forgot your password…
And they all develop their own shitty app for 2FA (the lazy ones just rebrand SecureGo as their own - you still have to install all of them separately) instead of using the 15 year old TOTP standard. The latter is good enough for tiny companies like Google and Amazon but what do they know about itsec, right?
Heath Ledger started banking here in the year 2000. Only movie producers have debit cards right and all actors are on a cash only basis and actors are cannibals that rob and eat their prey.
I mean you all weren’t ripping or watching Hollywood movies on the internet right? Because that’s just a cheap way for producers to store things so there isn’t giant dvd and vhs recording machines. Taking up space in print shops. Printing t shirts just went on because that blonde chick in ten things I hate about you did acting as a source of income and because it was an art but she preferred real art but didn’t see selling statues as a source of income or steady income. Sometimes large durable good purchases weren’t supported in capitalism. So it was T shirt printing and that genre of music that took place during those years. They’d all run around stabbing and killing all these other people as like a cult. The world was somewhat French back then.
And simulations are just used for movie production so that actors don’t miss their cues or start eating things and robbing and killing each other on the set.
Heath Ledger is kidnapped not dead, if he didn’t die as his stage name or other self then hepatitis b does this to him, and that’s why there was glucose in Mountain Dew and potassium in everything else as a preservative and no one could really eat natural foods or supposedly natural cheeses and butter. And that’s one thing I hate about you.
My credit union’s web site looks like a MySpace page. They don’t even offer freaking 2FA. Been meaning to transition to cash management account but such a PITA.
I have an account with a larger credit union and their Android app implements onerous rules which some exec must feel makes it more secure, but is just a burden 99.999% of the time. Today I found that the fingerprint login expires after a week of not logging in, requiring the username/password to log in. Annoying but ok, I log in with a username and password. Then it says I need to do MFA and presents 3 options, email, SMS, and app push notification. The UI for app push notification even says “This device”. I selected that one, and the app shows the approve/deny button over the MFA requirement screen.
So obviously the saved state in the app wasn’t actually expired, since it could still approve MFA requests. So what good is it expiring biometric auth if the app is still authorized to log me in effectively bypassing MFA?
So obviously the saved state in the app wasn’t actually expired, since it could still approve MFA requests. So what good is it expiring biometric auth if the app is still authorized to log me in effectively bypassing MFA?
GrapheneOS is made by diva developers who frankly should not be trusted. “We only allow Google phones to run our OS!” as if they don’t have a backroom deal with Google.
Pure wild speculation if I’m honest, however I’d be more surprised if I was completely wrong. It’s always seemed sketchy the way Google have basically said “Use our phone, it’s more secure!” with their Nexus and Pixel phones - this was long after the time Google stopped not being evil. At best, the security problems have simply changed manufacturer. Also, Google have a history of undermining development of circumvention, eg hiring the developer of MicroG and forcing him to stop development as a term in his contract.
The diva part is widely known, GrapheneOS developers don’t play nice with the rest of the custom development community. So, while I can’t substantiate any actual deal between them and Google, it’s the perfect recipe.
i see. i bought my phone second hand, so google isnt getting money from the sale, but i can see the problem with every user relying on the same phone manufacturer
What are the security issues? Rooted just means the potential to give trusted apps root access. Of course, if you give an app root access that you trust but is then abusing that trust and being malicious, yes it’s a security issue. But if you don’t do that, the simple fact of having a rooted phone should have no security change in any way. (Ok, except for potential bugs in Magisk/su or whatever)
If you have the UI layer able to grant root access, it has root access itself and is not sandboxed. If the UI layer can grant it, an attacker gaining slight control over it has root access. An accessibility service trivially has root access. A keyboard can probably get root access, and so on. Instead of a tiny little portion of the OS having root access, a massive portion of it does.
In the verified boot threat model, an attacker controls persistent state. If you have persistent root access as a possibility then verified boot doesn’t work since persistent state is entirely trusted.
A userdebug build of AOSP or GrapheneOS has a su binary and an adb root command providing root access via the Android Debug Bridge via physical access using USB. This does still significantly reduce security, particularly since ADB has a network mode that can be enabled. Most of the security model is still intact. This is not what people are referring to when they talk about rooting on Android, they are referring to granting root access to apps via the UI not using it via a shell.
But granting root is not done by “the UI layer”, “the UI layer” is not running with root. There is no such thing as “the UI layer” as a separate entity, an app can have a UI layer as part of its architecture, but the UI is not running on its own. Just because Magisk shows you a UI for you to grant/deny a root request, that doesn’t make it insecure. Nothing is able to interact with this prompt except the Android kernel/libraries itself and Magisk.
Only if you added an application as accessibility tool (or give it root) can it interact with anything within the UI. An app with a UI is generally not much different than an app on the command line.
It still create an attack vector, as it allows a potential extra method to get access to it, in addition of potential hardware exploits that i shared to gain root.
Yes, you can minimize the risks correctly, but the user is the only real barrier against it, not the software anymore.
The less potential way to exploit your phone, the better it is. You shouldn’t rely on thinking that such feature is fully attack-proof.
The whole issue revolves around the fact Google is presuming a device is compromised or being used for illicit shit simply because root access is possible. If they put in effort to detect/prevent the actual problems they’re concerned about, this wouldn’t be as big a deal. This broad punishment for simply having root access is lazy and ridiculous.
It’s like if Windows apps just stopped working if they detected a local admin account. It’s patently absurd to assume the ability to access anything means the device is inherently “unsafe”.
Only big manufacturers can really pay to control entirely the hardware inside it, and allow you to modify it. Checkout Fairphone for example. They’ve been forced to stop hardware security updates due to their chip manufacturer, who refused to continue supporting it, despite them trying to support their devices for plenty more years.
This explains the choice with Google.
thats fair. device support is a major downside of GOS. but, remember: its not really the fault of the OS, as it requires a lockable/unlockable bootloader, which only pixel phones provide (at least in terms of mainstream phones). blame the OEMs like samsung
That’s the main issue really, as it open the possibility to manage your device for anyone getting hold of it. Probably some debug attack methods also with it.
You are being downvoted because you’re factually wrong. While Android (especially on Samsung devices) had been getting more locked down over the years, even unrooted it has way more freedom than an iPhone. For instance, you can install any number of APKs, without jumping through any hoops.
You can’t do that without unlocking the bootloader, and that alone will trip “root detection” (Play Integrity).
Some apps take it further and won’t run if you enable Developer Options! (Or have any number of “hacking apps” installed, such as autotap apps that don’t even need root.)
If they work with an unlocked bootloader then they would almost certainly also work fully rooted, with the advantages that brings (such as actual working app+data backups, limiting max battery charge, better automation possibilities with apps like Tasker, etc)
I’d much rather switch banks than give up rooting my phone.
Well you can, and there is no punishment, so you should be happy.
I imagine you probably think “punishment” is that some bank won’t let you use their app on a rooted phone. That is not a punishment, that’s the bank implementing the security that they deem necessary for access to their software, and is likely part of a license agreement that you agreed to by using it. You have no default entitlement to have free use of the software that anyone else produces unless the software developer’s license states that you do.
Actual punishment would be if your phone gets bricked by the OEM for rooting it, or government authorities fine or arrest you for rooting.
Rooting is unnecessary now and that’s a good thing.
Rooting is always necessary, you can’t convince me otherwise, imagine not having root permissions in your Windows, Linux or macOS machine…
Without “rooting” capabilities we wouldn’t have custom firmware for tech that is quite locked (like the PSP, Vita, 3DS and whatever OS they use), emulation would not be the same.
Heck, even some iOS versions can be jailbroken yet, I cannot conceive a world where iOS is less locked than Android.
You need to be the one who decides how your hardware is managed.
Because they think it matters. Same as people posting on Facebook some legalese saying “Facebook doesn’t have the rights to my stuff.”. They think that by slapping a copyright “claim” on their stuff that they supercede the agreements of the platform and somehow protect their comments from being scrapped by bots/advertisers, etc. All it really does is add a little “this guy is probably a sovereign citizen type” sign to every post they make.
Funnily enough I had issues with Wallet working on my phone since I have unlocked bootloader but no root. Banking and everything else afaik worked. So I installed all that stuff, Magisk, Magisk Hide, I don’t even remember all the things I tried and what it resulted in was now since I was actually rooted all the banking apps and other stuff stopped working.
When you root, you’re creating more flags for apps to detect, so you have to put in more effort to hide them all. That means a greater likelihood of something being detected if you missed it. It’s a trade off. You do have to learn a bit about what you’re doing and do some trial and error.
But the greater point is, if banking apps and wallet are important to you on that specific phone, you can either root and put in the effort to make it work, root and just do all that stuff from a browser, or not root at all.
Yeah, it’s annoying, but it isn’t the fault of Magisk or the rooting community, it’s Google and your banks fault for actively punishing you for using your own device the way you like.
Personally, I have two phones now. My main one is rooted, and if I need an app that breaks on root, I pull out the “clean” one (my old phone after factory reset). Use a hotspot if mobile.
For me it’s important that my banking works (so far they haven’t complained about unlocked bootloader, only about root) but Wallet is just nice to have. And that doesn’t work with unlocked bootloader but did work with root. I guess it’s no root for me since I haven’t managed to juggle them both.
Sucks that Google is doing this. I don’t even have root and they are complaining. Makes having a custom rom annoying sometimes.
This reeks of servitude/wishful thinking mentality. You do realise that vendors have root access, right? So what, when they do it it’s secure because of their magical vendor status? Or is it because they hide the implementation details?
My former bank launched a sub-bank that was 100% outsourced. App and website only, no branches, no ATM’S, no phone number, just some software and a card. I dumped them for a competent bank after 25 years with them
I’m actually ok if they passed on the saving of not having to operate branches to their customers in the form of lower fees, a higher interest rate for saving accounts, better credit card rewards, etc.
I’ve seen a website that silently truncated my password during a password reset, but then wouldn’t truncate it during login. It took me a while to figure out why my password never worked.
With the PNC bank I use, about 12 years ago, passwords used to be case insensitive, and they would allow ridiculously insecure passwords without complaining, like one123. I had a ridiculous password like that for a while because it was funny, then realized I’d be the one to pay for it.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
I hate this so much!
My bank is like that and another horrible thing is that after you choose your password (which can be long and complex) you need to choose a 6 DIGIT restore code incase you forgot your password…
Why is is my BANK so bad at security??
And they all develop their own shitty app for 2FA (the lazy ones just rebrand SecureGo as their own - you still have to install all of them separately) instead of using the 15 year old TOTP standard. The latter is good enough for tiny companies like Google and Amazon but what do they know about itsec, right?
genius
Wait
You have a second password that’s (opens calculator) 20 bits of entropy???
Heath Ledger started banking here in the year 2000. Only movie producers have debit cards right and all actors are on a cash only basis and actors are cannibals that rob and eat their prey.
I mean you all weren’t ripping or watching Hollywood movies on the internet right? Because that’s just a cheap way for producers to store things so there isn’t giant dvd and vhs recording machines. Taking up space in print shops. Printing t shirts just went on because that blonde chick in ten things I hate about you did acting as a source of income and because it was an art but she preferred real art but didn’t see selling statues as a source of income or steady income. Sometimes large durable good purchases weren’t supported in capitalism. So it was T shirt printing and that genre of music that took place during those years. They’d all run around stabbing and killing all these other people as like a cult. The world was somewhat French back then.
And simulations are just used for movie production so that actors don’t miss their cues or start eating things and robbing and killing each other on the set.
Heath Ledger is kidnapped not dead, if he didn’t die as his stage name or other self then hepatitis b does this to him, and that’s why there was glucose in Mountain Dew and potassium in everything else as a preservative and no one could really eat natural foods or supposedly natural cheeses and butter. And that’s one thing I hate about you.
sorry, what ?
My credit union’s web site looks like a MySpace page. They don’t even offer freaking 2FA. Been meaning to transition to cash management account but such a PITA.
I have an account with a larger credit union and their Android app implements onerous rules which some exec must feel makes it more secure, but is just a burden 99.999% of the time. Today I found that the fingerprint login expires after a week of not logging in, requiring the username/password to log in. Annoying but ok, I log in with a username and password. Then it says I need to do MFA and presents 3 options, email, SMS, and app push notification. The UI for app push notification even says “This device”. I selected that one, and the app shows the approve/deny button over the MFA requirement screen.
So obviously the saved state in the app wasn’t actually expired, since it could still approve MFA requests. So what good is it expiring biometric auth if the app is still authorized to log me in effectively bypassing MFA?
I love this and hate this so much
My bank luckily just slaps me with a huge warning screen every time I open the app.
My banking app requests root access which is funny
Get new bank
Magisk plus DenyList luckily works for my banks. Couldn’t imagine not having a rooted phone.
Beat the main purpose of GrapheneOS. Open the phone to a broad lot of security issues.
GrapheneOS is made by diva developers who frankly should not be trusted. “We only allow Google phones to run our OS!” as if they don’t have a backroom deal with Google.
@TWeaK @PoorPocketsMcNewHold @android
Bullshit
Just logical. If you gain the privilege to modify system bits, then it just open the potential for attacks abusing root access. And it has been done already. You are just removing one step for them. https://www.bleepingcomputer.com/news/security/loki-trojan-infects-android-libraries-and-system-process-to-get-root-privileges/ https://www.bleepingcomputer.com/news/security/highly-advanced-spydealer-malware-can-root-one-in-four-android-devices/ https://www.bleepingcomputer.com/news/security/new-abstractemu-malware-roots-android-devices-evades-detection/ https://promon.co/security-news/fjordphantom-android-malware/
genuinely curious; can u elaborate on the deal with google?
Pure wild speculation if I’m honest, however I’d be more surprised if I was completely wrong. It’s always seemed sketchy the way Google have basically said “Use our phone, it’s more secure!” with their Nexus and Pixel phones - this was long after the time Google stopped not being evil. At best, the security problems have simply changed manufacturer. Also, Google have a history of undermining development of circumvention, eg hiring the developer of MicroG and forcing him to stop development as a term in his contract.
The diva part is widely known, GrapheneOS developers don’t play nice with the rest of the custom development community. So, while I can’t substantiate any actual deal between them and Google, it’s the perfect recipe.
i see. i bought my phone second hand, so google isnt getting money from the sale, but i can see the problem with every user relying on the same phone manufacturer
Proove us that you can get better security while remaining able to be fully modified with other phones and brands. https://www.privacyguides.org/en/android/#divestos
Privacy Guides has a bit of a sordid history of their own diva behaviour.
Just higher standards.
Nah they’ve been accused of biases.
What are the security issues? Rooted just means the potential to give trusted apps root access. Of course, if you give an app root access that you trust but is then abusing that trust and being malicious, yes it’s a security issue. But if you don’t do that, the simple fact of having a rooted phone should have no security change in any way. (Ok, except for potential bugs in Magisk/su or whatever)
https://www.reddit.com/r/GrapheneOS/comments/13264di/comment/ji54e19/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button
I’m pretty sure whoever wrote that was talking out their ass. The fuck is “UI layer” on Android, or rather, what does it have to do with it xD
The actual Magisk prompt that ask you if you want to give root to such app. This UI layer.
Although, i suppose it could be countered by explicitly refusing all requests or enabling a biometric confirmation
But granting root is not done by “the UI layer”, “the UI layer” is not running with root. There is no such thing as “the UI layer” as a separate entity, an app can have a UI layer as part of its architecture, but the UI is not running on its own. Just because Magisk shows you a UI for you to grant/deny a root request, that doesn’t make it insecure. Nothing is able to interact with this prompt except the Android kernel/libraries itself and Magisk.
Only if you added an application as accessibility tool (or give it root) can it interact with anything within the UI. An app with a UI is generally not much different than an app on the command line.
It still create an attack vector, as it allows a potential extra method to get access to it, in addition of potential hardware exploits that i shared to gain root. Yes, you can minimize the risks correctly, but the user is the only real barrier against it, not the software anymore. The less potential way to exploit your phone, the better it is. You shouldn’t rely on thinking that such feature is fully attack-proof.
The whole issue revolves around the fact Google is presuming a device is compromised or being used for illicit shit simply because root access is possible. If they put in effort to detect/prevent the actual problems they’re concerned about, this wouldn’t be as big a deal. This broad punishment for simply having root access is lazy and ridiculous.
It’s like if Windows apps just stopped working if they detected a local admin account. It’s patently absurd to assume the ability to access anything means the device is inherently “unsafe”.
But the previous commenter talked about security issues, you’re only talking about usability issues.
Graphene only works for Pixel phones, and I don’t want a Google device.
@viking @PoorPocketsMcNewHold @android
Then don’t bother, there’s no GrapheneOS for you!
Yeah, that was their point.
Only big manufacturers can really pay to control entirely the hardware inside it, and allow you to modify it. Checkout Fairphone for example. They’ve been forced to stop hardware security updates due to their chip manufacturer, who refused to continue supporting it, despite them trying to support their devices for plenty more years. This explains the choice with Google.
thats fair. device support is a major downside of GOS. but, remember: its not really the fault of the OS, as it requires a lockable/unlockable bootloader, which only pixel phones provide (at least in terms of mainstream phones). blame the OEMs like samsung
There are a ton of unlockable bootloaders. On my OnePlus that’s a matter of flipping a switch in the settings.
can it be re-locked? i may be wrong, btw. this is just what ive heard.
I don’t know, never tried that.
That’s the main issue really, as it open the possibility to manage your device for anyone getting hold of it. Probably some debug attack methods also with it.
Mainstream phones? Pixel is a smaller market share than Motorola, and Motorola has unlockable bootloaders, and lineage supports a fair number of them.
I thought Google owned Motorola, but I missed the sale to Lenovo ten years ago.
deleted by creator
Sadly, can’t be re-locked. Would have loved to get a Motorola if it was.
don’t give root to any app duh
Non-rooted phones are just like iPhones. Ewww…
Like bicycles with training wheels.
Agree, don’t get why you are being downvoted.
removed by mod
You are being downvoted because you’re factually wrong. While Android (especially on Samsung devices) had been getting more locked down over the years, even unrooted it has way more freedom than an iPhone. For instance, you can install any number of APKs, without jumping through any hoops.
As a I said before, I don’t care about downvotes. Be my guest.
That’s ok an all, but I assumed that you do care about making a false statement, which was the point of my response, to let you know.
For now. Google’s recent patterns would seem to indicate the future trajectory of Android to become even more hobbled.
I doubt it will ever be as closed as iPhone but there’s a point where the door is technically still open, just not in a way that really means much.
Can you compile your own OS from source for an iPhone and install it yourself? I don’t think so.
I have done that with my non-rooted android, and I can do anything I want with my phones through the powers of open source software.
Rooting is unnecessary now and that’s a good thing.
You can’t do that without unlocking the bootloader, and that alone will trip “root detection” (Play Integrity).
Some apps take it further and won’t run if you enable Developer Options! (Or have any number of “hacking apps” installed, such as autotap apps that don’t even need root.)
Yes, I am aware of how it works. Unlocking the bootloader is not the same as rooting, and all my apps work just fine.
If they work with an unlocked bootloader then they would almost certainly also work fully rooted, with the advantages that brings (such as actual working app+data backups, limiting max battery charge, better automation possibilities with apps like Tasker, etc)
I’d much rather switch banks than give up rooting my phone.
Who cares if it’s necessary? If people want to do it, they should be able to, without punishment.
Well you can, and there is no punishment, so you should be happy.
I imagine you probably think “punishment” is that some bank won’t let you use their app on a rooted phone. That is not a punishment, that’s the bank implementing the security that they deem necessary for access to their software, and is likely part of a license agreement that you agreed to by using it. You have no default entitlement to have free use of the software that anyone else produces unless the software developer’s license states that you do.
Actual punishment would be if your phone gets bricked by the OEM for rooting it, or government authorities fine or arrest you for rooting.
Rooting is always necessary, you can’t convince me otherwise, imagine not having root permissions in your Windows, Linux or macOS machine…
Without “rooting” capabilities we wouldn’t have custom firmware for tech that is quite locked (like the PSP, Vita, 3DS and whatever OS they use), emulation would not be the same.
Heck, even some iOS versions can be jailbroken yet, I cannot conceive a world where iOS is less locked than Android.
You need to be the one who decides how your hardware is managed.
🚨 Improper use of meme format 🚨
wait really? :/
I’m pretty sure panel 2 and panel 4 should have the same text
THIS MOTHERFUCKER MEMED WRONG
ok, sure, but the 4th is basically a rephrasing of the 2nd… close enough
🦴💥 Bone Hurting Juice detected 💥🦴
Your banks still have offices? Cool!
yeah but they are closing the ones near me :(
They need to since PNC doesn’t have a functioning app or website
I moved to a bank that allows non google phones and let my previous bank know why I left.
CC BY-NC-SA 4.0
Why are you licensing your comments
Because they think it matters. Same as people posting on Facebook some legalese saying “Facebook doesn’t have the rights to my stuff.”. They think that by slapping a copyright “claim” on their stuff that they supercede the agreements of the platform and somehow protect their comments from being scrapped by bots/advertisers, etc. All it really does is add a little “this guy is probably a sovereign citizen type” sign to every post they make.
There is no such platform agreement on lemmy, so they might have at least a little bit of a chance
at least its CC :)
Magisk Hide + app rename works most of the time, for those with rooted phones
Funnily enough I had issues with Wallet working on my phone since I have unlocked bootloader but no root. Banking and everything else afaik worked. So I installed all that stuff, Magisk, Magisk Hide, I don’t even remember all the things I tried and what it resulted in was now since I was actually rooted all the banking apps and other stuff stopped working.
When you root, you’re creating more flags for apps to detect, so you have to put in more effort to hide them all. That means a greater likelihood of something being detected if you missed it. It’s a trade off. You do have to learn a bit about what you’re doing and do some trial and error.
But the greater point is, if banking apps and wallet are important to you on that specific phone, you can either root and put in the effort to make it work, root and just do all that stuff from a browser, or not root at all.
Yeah, it’s annoying, but it isn’t the fault of Magisk or the rooting community, it’s Google and your banks fault for actively punishing you for using your own device the way you like.
Personally, I have two phones now. My main one is rooted, and if I need an app that breaks on root, I pull out the “clean” one (my old phone after factory reset). Use a hotspot if mobile.
For me it’s important that my banking works (so far they haven’t complained about unlocked bootloader, only about root) but Wallet is just nice to have. And that doesn’t work with unlocked bootloader but did work with root. I guess it’s no root for me since I haven’t managed to juggle them both.
Sucks that Google is doing this. I don’t even have root and they are complaining. Makes having a custom rom annoying sometimes.
deleted by creator
This reeks of servitude/wishful thinking mentality. You do realise that vendors have root access, right? So what, when they do it it’s secure because of their magical vendor status? Or is it because they hide the implementation details?
My former bank launched a sub-bank that was 100% outsourced. App and website only, no branches, no ATM’S, no phone number, just some software and a card. I dumped them for a competent bank after 25 years with them
I’m actually ok if they passed on the saving of not having to operate branches to their customers in the form of lower fees, a higher interest rate for saving accounts, better credit card rewards, etc.
That’s not how outsourcing works. They save 75% on costs but only decrease prices 10%. Just enough to undercut the competition.
Does chime do this?
Are you 100% certain they don’t just truncate your password to 8 characters?
i would not be surprised. i will have to try
I’ve seen a website that silently truncated my password during a password reset, but then wouldn’t truncate it during login. It took me a while to figure out why my password never worked.
Name & shame please
What, do you think banks have the money for storing all those extra unnecessary characters? MS Access databases are only so powerful.
Since when does MS access run on IBM mainframes?
Never ever ever store passwords in the database. Salted hash only. It’s fixed length even if the password is a gigabyte long.
Your bank are allowing you to use characters ? Mine only allows numbers for the password, it has to be 8 number, no less, no more.
With the PNC bank I use, about 12 years ago, passwords used to be case insensitive, and they would allow ridiculously insecure passwords without complaining, like one123. I had a ridiculous password like that for a while because it was funny, then realized I’d be the one to pay for it.