Ask HN: A major USA bank is storing passwords in cleartext

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#31

Post by jakelazaroff » Tue, Feb 18, 2020, 7:10 AM UTC

matz1 wrote: post #19

danbolt wrote: post #16

Earlier quoted context omitted.

I feel the bank should be liable for stolen funds or information in the case of a security breach.

Yes, I expect the bank to protect my money. What I'm saying is how they actually do it, clear text pwd or whatever is not really my concern. Why should I ?

You’re right, you’ll probably get your money back if your password gets stolen.

Eventually. Might be real disruptive if you’re in the middle of buying a house.

I’d probably choose my bank to minimize my chances of dealing with a giant bureaucracy for however long (and the non–zero possibility that I actually won’t get my money back). But if that’s not “damage” to you, feel free to keep doing business with them!

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#32

Post by altcognito » Tue, Feb 18, 2020, 7:17 AM UTC

baron816 wrote: post #26

loteck wrote: post #20

Genuinely curious, why not name the bank here? It certainly isn't going to be news to the bank itself, so there aren't responsible disclosure concerns here. And since the top advice here is to leave the bank, wouldn't the best thing you can do be to alert the public, so others can protect themselves as well?

Looks like it’s PNC. Everyone here, move your money now.

Or don't make financial decisions based on vague anonymous internet comments until you've investigated for yourself.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#33

Post by matz1 » Tue, Feb 18, 2020, 7:18 AM UTC

jakelazaroff wrote: post #31

matz1 wrote: post #19

Earlier quoted context omitted.

Yes, I expect the bank to protect my money. What I'm saying is how they actually do it, clear text pwd or whatever is not really my concern. Why should I ?

You’re right, you’ll probably get your money back if your password gets stolen. Eventually. Might be real disruptive if you’re in the middle of buying a house. I’d probably choose my bank to minimize my chances of dealing with a giant bureaucracy for however long (and the non–zero possibility that I actually won’t get my money back). But if that’s not “damage” to you, feel free to keep doing business with them!

>Might be real disruptive if you’re in the middle of buying a house.

Agree, I consider this a damage but if the bank can avoid causing me any disturbance despite of using clear text password or then why should I be concerned ?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#34

Post by netsharc » Tue, Feb 18, 2020, 7:23 AM UTC

davismwfl wrote: post #2

Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#35

Post by prklmn » Tue, Feb 18, 2020, 7:28 AM UTC

altcognito wrote: post #32

baron816 wrote: post #26

Earlier quoted context omitted.

Looks like it’s PNC. Everyone here, move your money now.

Or don't make financial decisions based on vague anonymous internet comments until you've investigated for yourself.

Do you want this person to mount a full blast investigation on their own? Most banks are mostly interchangeable nowadays unless you live in a small town and there’s only one bank you must use because you’re transacting with cash. They pay nearly zero interest, and they treat their customers like trash with monthly fees galore.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#36

Post by Carpetsmoker » Tue, Feb 18, 2020, 7:35 AM UTC

matz1 wrote: post #15

Is there actual damage? At the end of day, as a customer，all I care is my money is available (not stolen) and I can access it when I need it. Why should I care about implementation details ?

Would you trust a bank that protects their vault with the same kind of lock as your front door?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#37

Post by godferthomy » Tue, Feb 18, 2020, 7:35 AM UTC

matz1 wrote: post #25

toper-centage wrote: post #23

Earlier quoted context omitted.

Sounds like they are open to social engineering attacks, if you can get a rep to describe the password to you... Meaning I could pretend to be you and get your money.

Maybe but that is their problem. Its still the bank responsibility to deal with that.

Well any risk is going to be paid by the customer in the end. If they lose 0.01% of their deposits because of a vulnerability, they're gonna be charged more by their insurance and eventually charge it on their service fees to customers.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#38

Post by lpilot » Tue, Feb 18, 2020, 7:35 AM UTC

Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#39

Post by alltakendamned » Tue, Feb 18, 2020, 7:38 AM UTC

It seems you're not getting serious answers here, so here's my take.

Please report this via the US-CERT at https://www.us-cert.gov/report

This will allow you to report it, eventually from an anonymous email address, without exposing you directly to the bank which might react bad to you. CERT can handle the coordination with the bank, this is what they do.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#40

Post by afarrell » Tue, Feb 18, 2020, 7:47 AM UTC

matz1 wrote: post #33

jakelazaroff wrote: post #31

Earlier quoted context omitted.

You’re right, you’ll probably get your money back if your password gets stolen. Eventually. Might be real disruptive if you’re in the middle of buying a house. I’d probably choose my bank to minimize my chances of dealing with a giant bureaucracy for however long (and the non–zero possibility that I actually won’t get my money back). But if that’s not “damage” to you, feel free to keep doing business with them!

>Might be real disruptive if you’re in the middle of buying a house. Agree, I consider this a damage but if the bank can avoid causing me any disturbance despite of using clear text password or then why should I be concerned ?

The same reason you might be concerned even if a doctor can deliver a baby safely despite not washing his hands in between a cadaver examination and touching your wife.

Do you feel lucky? Well, do ya?