Chase is recommending you don't share your Chase.com login information with Mint, Credit Karma, Personal Capital etc. and is absolving themselves of responsibility for any money you lose.

It looks like you are responding to XKCD rather than my post regarding Big-O.

With shorter passwords you'll get more benefit from adding another letter; with longer passwords you'll get more benefit from making it case-sensitive. The reason for this is the relative benefit from case-sensitivity also increases exponentially in the length of the password.

Your arguments regarding your first and second objection all seem to be stemming from this statement, so I will address this base argument specifically.

You are actually right that the benefit of case-insensitivity is exponential and not constant, but it is still much less than adding a letter. With longer passwords, adding extra letters gets you even more benefit.

Let's address your fourth objection as well and say that for this examples, only letters are allowed. No numbers or symbols. This way, we get the worst possible benefits for adding letters and the best possible benefits for adding case sensitivity. Let's n is the length of the password. For a password we know is case-insensitive, the number of possible combinations is 26n since there are 26 letters.

Let's say we add case-sensitivity. That means we double the number of possible letters. The new number of combinations is (2(26))n , or 52n

Let's say we add a letter to the password instead. The new number of combinations is 26n+1 .

52n is less than 26n+1 for all n greater than 0.

Therefore, mathematically speaking, there is no password length where you benefit more by adding case sensitivity than by adding letter, regardless of whether the password allows for symbols or numbers. If you disagree, I would like to see the math.

As for your third objection, thats not really a hard "security" issue as much as it is a disclosure issue. I agree that they should make it as obvious as possible, but I certainly wouldn't use case-(in)sensitivity to increase or decrease my password length. If I did, I would just an extra letter and be done with it.

/r/personalfinance Thread Parent