Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

221–230 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#221

Post by vegardx »

It never ceases to amaze me what the state of online banking is around the world.

Here we have something called BankID which comes in two flavors, one that is a physical token that generates TOPT used to log in, either in a combination with a password or a PIN on the token device itself, referred to as BankID. And the other, much slicker solution, called BankID on Mobile, which runs as SIM-application on your phone where you digitally sign the login request using a PIN. The user can also verify the request visually on both the computer and phone using a unique keyword.

One killer feature with BankID is that you can use it to log in to any service that has BankID, like your insurance company, looking at your tax return, other banks, etc. This is perhaps the biggest issue with it since the system can get overloaded when there's a country wide rollouts of tax returns and such. This has become much better lately since they've started to roll out things like tax returns as soon as they're ready instead of doing bulk releases.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#222

Post by mqus »

milkytron wrote: post #166
tantalor wrote: post #151

Earlier quoted context omitted.

> For many banks and other financial institutions, going down for even 1 hour is a complete catastrophe. Are you joking? It's a common trope for bank websites to go down for "scheduled maintenance". Not to mention real-world bank branches keep bizarre hours and close for random holidays like Presidents' Day and Veterans' Day. Why do banks and credit card companies need to perform "scheduled maintenance" during which…

Even though websites are really important, I think they mean other business critical services going down for an hour. Imagine if all credit cards with a company failed to process transactions for an hour, or depositing/withdrawing money didn't make a change to your balance. Those types of issues are much more severe than a customer not being able to log in to the website.

You know, those kind of things already happen. Even I sometimes had issues with my credit card when paying online and usually there's another way or you could just pay an hour later.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#223

Post by dontbenebby »

alltakendamned wrote: post #39

It seems you're not getting serious answers here, so here's my take. Please report this via the US-CERT at https://www.us-cert.gov/report This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

This very looks cool, thank you for sharing parent.

I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is.

(Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home)

I worry sometimes that we assume people reporting security vulnerabilities will be security experts.

I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#224

Post by empath75 »

carapace wrote: post #215
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

> As someone who works in finance/banking, I can assure you that this is not uncommon. And so, each time, you've reported them to this US-CERT thing the (current) top comment mentions so that proper steps can be taken, riiiiight? If you know about this and do nothing that's also part of the problem.

Did you know you can transfer money out of an account with nothing more than the checking account number that’s printed on all your checks along with your name and home address?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#225

Post by wtetzner »

yjftsjthsd-h wrote: post #210
Guest0918231 wrote: post #175

Earlier quoted context omitted.

The Canadian Revenue Agency website is down from 3am to 6am every single day for maintenance. They are also scheduled to be down for days at a time. https://www.canada.ca/en/revenue-agency/services/e-services/... This site is used for everything. Reviewing your taxes, reading mail and notifications you've received from the government, filing returns, making payments, etc.

That sounds amazing ... as an admin, I mean. Can you imagine being allowed to have scheduled downtime every day ? It does suck a bit for users, although honestly putting it at 3-6AM mitigates a lot of my concerns with that.

> although honestly putting it at 3-6AM mitigates a lot of my concerns with that.

As long as the website is only used in a single timezone, I guess it's not too bad.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#226

Post by dontbenebby »

bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

>As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with

Are there any standards that doing this violates, and if so do banks have a person in the org (or external to the org) that violations of said standard can report to?

> We are talking about password security in a system domain where there are arguably far more valuable assets to secure.

My worry is that because this is such a simple thing, if we allow ourselves to not do the best practice, where does it end? Especially since large organizations have many parts that don't communicate.

I agree we should think critically about risk, but I've also met lots of people who seem to backdate their logic - first they decide it's too onerous/costly to do a thing, then game out a reasonable enough reason why.

The problem with the latter is eventually your focus on compliance and handwaving will bite you hard, and you may not get a chance to be reactive because the breach will be so bad.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#227

Post by katbyte »

mqus wrote: post #222
milkytron wrote: post #166

Earlier quoted context omitted.

Even though websites are really important, I think they mean other business critical services going down for an hour. Imagine if all credit cards with a company failed to process transactions for an hour, or depositing/withdrawing money didn't make a change to your balance. Those types of issues are much more severe than a customer not being able to log in to the website.

You know, those kind of things already happen. Even I sometimes had issues with my credit card when paying online and usually there's another way or you could just pay an hour later.

Really? I’ve never experienced my credit or debit card not working (except in America where my Canadian debut card often will just not work)

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#228

Post by _-david-_ »

bodhi_mind wrote: post #109

Hashing passwords has been ingrained into our brains as it's an easy way to reduce risk. That said, sometimes sensitive information needs to be stored in a retrievable format (subscription credit card processing comes to mind). Every data decision that's made has an element of risk involved while accomplishing an end goal. With the right processes in place (encryption, limiting access (auditing that access), decrypti…

Can you name a single reason for having a password in a retrievable format? Credit cards, account numbers, etc need to be retrieved so it makes since to not hash them. Passwords on the other hand should only be known by you so there doesn't seem to be any reason to have a retrievable format for them.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#229

Post by dontbenebby »

spurdoman77 wrote: post #202
bob1029 wrote: post #139

As someone who works in finance/banking, I can assure you that this is not uncommon. Almost everyone is engaging in not-so-best practices with password storage if they are using any 3rd party vendors. Only the institutions with the resources to rebuild in-house systems with modern security standards are the exception to this rule. There are only a handful of these. Ultimately, it's not some malicious intent or incomp…

"For some strange reason when a bank calls the FBI things move with a high level of expediency." Is this really true? AFAIK illegal account accesses such as phishing etc is fairly commonplace. Criminals steal low value from lots of accounts, and also the way they steal is not really traceable, not at least easily. How would they even know where to send the guns? And also I'm not really convinced that FBI priorizes ba…

I once heard an ancedote, I forget if it was the FBI or Secret Service (who deal with some financial matters due to the weird hybrid nature of the agency), but one or the other, at the time, allegedly would not even begin to investigate a matter of less than 5000 USD. Now if you can establish it's one person making many sub-5K transactions they may, but that's hard to do if they won't take notice.

(The more I think the more I think it was the FBI, since the person also relayed that crimes against people often got short shrift since unfortunately one's feelings when threatened or harassed don't have an objective dollar amount)

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#230

Post by dontbenebby »

tentboy wrote: post #96

Since it seems this is PNC, I am one of those who now needs to find a new bank. Any recommendations? I used PNC for my checking/credit but already use an american express high yield savings. I was thinking maybe Capital One?

Where are you located?

I've had good experiences with Dollar Bank if you're in Pittsburgh.

Post reply on HN