actually it checks if there are special characters and 8 characters or more;

if this is true use the new method

if this is false take just the first 8 characters and use the old method

ahh ic, got it got it, before dis i thought their backend can only accept 8 chars MAX regardless of special chars n the logic doesnt make sense to me

This is bank. BNM doesn't allow your system to send data to 3rd party. If its not bank, this is acceptable. event letsencrypt cert is a bad idea to use. unless cimb can wack bnm regulator and say allow it lol.

I think this has become a bit of a convoluted mess:

Lets summarize a bit

1) CIMBClicks used to only allow 8 characters in password

2) Knowing that only allowing 8 characters in password is dumb, CIMB increased it to allow for longer until 20 characters this month

3) This is where i think the bug happen, those who have not changed their password after the change in (2), can login with extra characters

4) those who then change their password, can no longer login with extra characters <---- PROOF that it is not an intended feature

5) Brute Force attack may or may not be related, but timing is interesting. We know got brute force because thats what the recaptcha is for.

6) Some are questioning whether extra characters at the end is security compromise if the attacker would need to know the original password anyway (hence the brute force). BUT read about buffer overflow attack and you would now that it is a point of vulnerability in a system that are suppose to be water tight because it safeguard money. They may or may not be using this vulnerability, nobody knows

7) Those who are attacked (due to weak password/ using the same password as leaked in previous database leak -im looking at you jobstreet-), somehow got their debit card linked to an unknown paypal, and it will then be use to pay somebody (may or may not be third party and unrelated)

Example if your password is 123456789 without special characters, the stupid logic will take the first 8 characters and log you in. That is why any characters after the first 12345678 does not matter.

Example if your password is 123456789!@, then the system still logs you in because it has special characters, so the length can be up to 20 as long as it has special characters.

Point in question .. does cimb logout or block people after 3 attempt ?

Because their website clear state that they do

yup, that means their backend got 2 types of verification, 1 for legacy 8 chars pass and the other for newer pass wif special chars, they should reject pass >8 chars n no special chars instead of substring 

if i read correctly,

if password following the new format (have special characters and more or equal to 8 characters) then password will be as it is

else if old password format (8 characters), it will only take first 8 characters. any characters behind don't care..kena chopped

hek eleh.. nak cover le tew

o wai

yup, that means their backend got 2 types of verification, 1 for legacy 8 chars pass and the other for newer pass wif special chars, they should reject pass >8 chars n no special chars instead of substring 

if got special characters and >= 8 characters, it will pass to server as it is
else it will chop off after 8 characters.

topkek betul. that's why your password + any characters behind still can pass

I was against calling CAPTCHA a "speed bump".

as you said, it is entrenched way to quickly determine humans vs bots.
if implemented properly, though not foolproof, it does filter the "less-educated" bots. for "educated" bots, CAPTCHA is not a "speed bump", can solve in fractions of nanoseconds.

people are taking shortcut by blaming cimb, which have their own fault.

it's paypal that people should be burning, for allowing the fraud to happen. they should support 3D Secure, but they chose not to.

not my line of work.
you google computer vision and image recognition.

Or backend should reject passwords <8 with no special chars. Only except password length of 8 or more with special chars. They can force all users to change it and they can delete legacy code.

dun understand

if password more >= 8 char, then the first condition wont satisfy

if password is <8 char, then it only check up to 8th character

no conflicts what

people are taking shortcut by blaming cimb, which have their own fault.

it's paypal that people should be burning, for allowing the fraud to happen. they should support 3D Secure, but they chose not to.