Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#141

Post by kevin_thibedeau »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

So they can add columns for 2FA but strengthened password storage is not doable?

This was forgivable 30 years ago. It was bad practice 20 years ago. Someone could have demonstrated leadership and developed a ten year plan to fix their legacy problem then.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#142

Post by tentboy »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

As someone who uses the bank being referred to in the OP, this makes me feel a little better... somehow. I use a unique password and 2FA and monitor my accounts but I am still considering switching banks to one that puts more emphasis on security.

You mentioned that only a few banks have the resources to tear down their systems and create a new secure one. What banks are these?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#143

Post by allemagne »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

>How much ripping would HN impose on one of these institutions if they attempted a 100% best practices secure password upgrade and then subsequently had a complete IT disaster unfold (I can certainly link articles).

I'm definitely interested in examples of this

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#144

Post by jermaustin1 »

lb1lf wrote: post #123
giancarlostoro wrote: post #77

Earlier quoted context omitted.

> Your security as a bank customer hinges on more than just one password, it's also about monitoring patterns of behavior, being aware of what's coming and going from your account, and protection mechanisms like the bank's insurance. Some banks do this better than others from past experience. For example, I definitely have Bank of America notify me when I do something out of the ordinary. I had gone to a gas station…

> I definitely have Bank of America notify me when I do something out of the ordinary. -And such routines are incredibly efficient; while commissioning one of our deliveries (heavy engineering equipment) in Namibia a few years ago, I found that the local power electronics distributor hadn't heard of my employer, and were (reasonably so) reluctant to hand over parts for $13,000 or so and send an invoice to Norway. VIS…

Lucky you. You got a phone call before just declining it! /sarcasm

Story time:

I was in London, on a multi-week vacation when my CapitalOne card got declined while trying to pay for dinner on the 3rd night using Apple Pay (for the contactless feature).

It wasn't an expensive meal.

There was no warning, no text-message, no phone call. I opened the CapitalOne app and it said my account is now restricted. I proceeded to call CapitalOne, and sit on hold, then get transfered a couple of times until there was a person who could flip the switch.

I paid for dinner, and my wife and I started back to our hotel. Half-way there, we stopped off at a Boots Chemist, and picked up some allergy medicine. Card declined again. I knew it was going to take 30+ minutes to deal with it, so I paid cash and we left.

When we got to the hotel, I had to call back, deal with the same multiple transfers to the person who could flip the switch. Then we would get 1 transaction through before it would get declined again. I eventually got a direct line to the guy who could flip the switch, and after the 5th time of me calling him, we spent a few hours investigating.

I have used this card in the UK for years on vacation. But increasingly merchants dislike the lack of pin, and needing a signature, so to be a good tourist, I decided to use it with Apple Pay, and that was apparently the combination that was killing my account.

The Apple Pay + UK card reader combination was apparently blanking out the CVV code for whatever reason, and while Capital One would allow a single transaction to fail that check, they would then suspend the account until a person verified the transaction was legit. My biggest gripe about this though was they did not even inform me each time it happened. So for the remainder of the trip I had to either dip the chip, and sign a receipt or pay a FX fee.

EDIT: Now that I'm thinking on it more, I think the reason the CVV was blank was because a CVV doesn't get used when your card is present. So I'm back to thinking this was a CaptialOne issue. They were seeing the transaction as a card-not-present transaction, instead of as a contactless transaction, at the time, I don't think they had contactless cards, so that might have not been a scenario they had accounted for.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#145

Post by btrettel »

_Understated_ wrote: post #62

Why not reach out to someone like Brian Krebs? He has a pretty large reach and can potentially make people take notice. Try @briankrebs on Twitter.

There's a blog specifically dedicated to highlighting examples of plain text storage of passwords too: https://plaintextoffenders.com/

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#147

Post by Recursing »

daveoc64 wrote: post #87
deforciant wrote: post #58

Earlier quoted context omitted.

Other banks in UK do that as well, shouldn't they all be reported for this?

To whom, and on what basis? There is nothing in UK law that says banks have to store your passwords "securely". Issues like this have been raised in the past, and authorities like the ICO have said no law is being broken. GDPR, for example, does not specify technical mechanisms required to store any form of data.

See https://news.ycombinator.com/item?id=22356101

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#148

Post by zrobotics »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

Just checked to re-confirm: Wells Fargo passwords are case insensitive as well. This doesn't confirm that they store passwords in plaintext, as you said they may just convert to uppercase before hashing, but it is bad practice either way.

There is a lot more possible entropy if QwErTy and QWERTY are distinct. However, there seems to be issues in the entire financial sector with inability to upgrade certain systems due to massive amounts of legacy code. That being said, my local credit union's system distinguishes case for passwords; and they were unable to give a family member their password (they had to issue a reset) which at least leads me to believe they are hashing passwords instead of storing in plaintext.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#149

Post by jccooper »

slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

They also disallow certain common punctuation, which is indicative of either storing in cleartext, a really dumb hash function, the inability to sanitize inputs, or someone who has no idea setting password policy. All of which are bad.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#150

Post by bob1029 »

tentboy wrote: post #142
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

As someone who uses the bank being referred to in the OP, this makes me feel a little better... somehow. I use a unique password and 2FA and monitor my accounts but I am still considering switching banks to one that puts more emphasis on security. You mentioned that only a few banks have the resources to tear down their systems and create a new secure one. What banks are these?

I cannot say which ones specifically, but if you OrderByDescending market cap and pick the top 5, you'd probably be looking at the only ones. Developing an in-house core banking system is a massive undertaking that is even larger than starting an entirely new bank from scratch (which almost never happens now). We are talking billions of dollars locked up just to start the project. Not even god himself could tell you if/when that project would complete. Bank cores are some of the most complex monstrosities on earth.
Post reply on HN