but i checked the code the logic says it will accept the password if its more than 8 characters and if the password is less than 8 characters it will take the first 8 chars, or am i wrong?

All banks in SG uses a hardware security token... except Citi and Standard chartered that uses mobile app token if im not mistaken.

Not sure if anyone has shared this in this thread, here's your response from CIMB 

CIMB denies its online banking system was hacked, assures all is secure
Malaysian bank CIMB denies security breach after customers say accounts compromised

Coded at the client side aka website there which by right should be at server side only.

Not sure if anyone has shared this in this thread, here's your response from CIMB 

CIMB denies its online banking system was hacked, assures all is secure
Malaysian bank CIMB denies security breach after customers say accounts compromised

Dem, I sudah kena...

I received SMS on 12/12 that my CIMB Debit Card which I never used to make online purchases at all was charged RM34.48 @ Shopbop.com???

WTH! I straight away called CIMB to block my account immediately & then proceed to replaced the debit card as per CS advice...

But that amount still 'earmarked' last I checked my CIMB account balance

Is it a good time to go berserk & wire out all my moneh to other accounts maybe?

Someone already shared.but i put in front page anyway.

Absolute garbage security

but i checked the code the logic says it will accept the password if its more than 8 characters and if the password is less than 8 characters it will take the first 8 chars, or am i wrong?

I have transferred all of my funds to another bank once the breech was known.

Personal suggestion : it would be better for you to do same.

There's the checking for special characters as well.

Recaptcha v3 eliminates the need for ticking the box, actually, recaptcha is very important related to server request. It eliminates bots from brute forcing their way to obtain your password from rainbow tables (hash of known passwords --- currently there are about 1billion combinations from all the leaked passwords available publicly). There are other methods too but on the front end this is probably one of the most cost-efficient methods to deal with this.

I was pretty surprised when people were saying it was hacked, recaptcha has been a standard for years in more developed application development.

Change Password: Seems like even with the correct CIMB Clicks ID and password, it still shows
Invalid User ID or Password [CLK00619]

Update: Guys, to change password:

1. CIMB Clicks ID: <Your existing ID>
2. CIMB Clicks Password: <If your existing password length is > 8, then key in your password until the length of 8>

Example, old password is: mypasswod (length of 9 characters). In order to change password successfully, just key in mypasswo

This is ridiculous but its true.

India IT guys are only good at coding, not at logic.

You give them broad or vague instructions they gonna use the simplest shittiest code to get the job done coz they won’t bother to think “what else might be needed”.

If you have a good PM or account manager that can communicate to them exactly what specifications are needed, they can do it. Just don’t expect them to think or figure out anything for you.
Project manager mana? Tester only tests based on test scripts provided by the project team and 99% of the time test scripts from project team is BS.
CAPTCHA is one of the easiest “security measure” to bypass and this is a billion dollar bank we’re talking about.

if got special characters and >= 8 characters, it will pass to server as it is
else it will chop off after 8 characters.

topkek betul. that's why your password + any characters behind still can pass

yup i noe, then that means even the logic of the code is wrong? suppose if the legacy server side only accept max 8 characters then the client side is only suppose to accept 8 chars n below n substring the pass wif > 8 chars

https://www.cimbclicks.com.my/pdf/201812-Cl...-Public-FAQ.pdf
sorry on mobile .. boleh tolong screenshot and upload

https://www.cimbclicks.com.my/pdf/201812-Cl...-Public-FAQ.pdf
sorry on mobile .. boleh tolong screenshot and upload

if got special characters and >= 8 characters, it will pass to server as it is
else it will chop off after 8 characters.

topkek betul. that's why your password + any characters behind still can pass

Refer to OldSchoolJoke.

Because they need to cater for old password format which is without special characters.

Because they need to cater for new password with special characters.

Thus this retarded logic.