please enter a 2-digit number password brains out

It feels wrong because 5 digits presents an extremely limited set of different possible combinations the password can be. Any thoughts?- Peter Ullrich September 15, 2019 This just feels wrong but I can’t come up with a strong argument against it.

My bank tells me that their exactly-5-digit password policy is secure since it has 1.5bn permutations and the account gets blocked after 3 attempts. This is actually one of those long-in-draft blog posts I finally decided to finish after seeing this tweet earlier on in the week: But firstly, let's just establish what's happening: People are Upset About Arbitrary Restrictions I want to help shed some light on why this practice happens and argue pragmatically both for and against. I want to put forward cases for both arguments here because seeing both sides is important.

Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter.

Please enter a 2-digit number password brains out