Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

311–320 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#311

Post by marcus_holmes »

dx034 wrote: post #288
marcus_holmes wrote: post #186

Earlier quoted context omitted.

That COBOL layer that underlies almost all of our infrastructure. It was written when the cost/benefit calculation of writing it involved "downsizing" thousands of clerks who were doing the job manually. It can't be replaced because the cost/benefit calculation of replacing it does not involve anything like those kinds of numbers. The benefits of avoiding even a major security incident just don't compare to the costs…

Some banks are replacing their core banking system with new software. It's extremely expensive, a huge risk (any delay in migration means time where customers can't use ATMs or cards) and the benefit vs just adding API layers on top isn't always clear. At some point everyone needs to modernize but there are very few people who'd want to take responsibility for a project that size. TSB customers have learned how painf…

Not only banks. I bought a house with the money I made on a Y2K project for a water authority's billing system. I doubt they've managed to work out how to replace that mess of COBOL without going broke.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#312

Post by matz1 »

diffeomorphism wrote: post #283
matz1 wrote: post #127

Earlier quoted context omitted.

Yes, at the end of the day, as long as the money is there when i need it, I don't really care how you store it.

You stopped reading after the first sentence?

I did read your whole post. Can you elaborate?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#313

Post by diffeomorphism »

matz1 wrote: post #312
diffeomorphism wrote: post #283

Earlier quoted context omitted.

You stopped reading after the first sentence?

I did read your whole post. Can you elaborate?

You only replied to the first part I wrote. The second part says that your stance is contradicting itself.

The following is meaningless:

> I don't care that it is insecure, as long as it is secure.

But the following would be fine:

> I don't care what they change it to, as the new solution is secure.

The point being that "stored in plain text, as long as it is secure" is impossible just like "water, as long as it is dry".

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#314

Post by dontbenebby »

schoen wrote: post #242
ghostpepper wrote: post #237

Earlier quoted context omitted.

> I often meet people who are intelligent and technical, but either do not understand security, or understand it in terms of confidentiality, integrity, and availability (CIA triad) and flounder when thinking about anonymity. Can you suggest any resources for a technical user who would like to learn more about this distinction?

You might like some of the papers at https://www.freehaven.net/anonbib/

A good one to start with would be this paper:

https://www.freehaven.net/anonbib/cache/chaum-mix.pdf

It's one of the earliest and very well cited.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#315

Post by matz1 »

diffeomorphism wrote: post #313
matz1 wrote: post #312

Earlier quoted context omitted.

I did read your whole post. Can you elaborate?

You only replied to the first part I wrote. The second part says that your stance is contradicting itself. The following is meaningless: > I don't care that it is insecure, as long as it is secure. But the following would be fine: > I don't care what they change it to, as the new solution is secure. The point being that "stored in plain text, as long as it is secure" is impossible just like "water, as long as it is d…

> I don't care that it is insecure, as long as it is secure

Ok let me clarify, I don't care if they use plain text pwd as long as it secure.

>The point being that "stored in plain text, as long as it is secure" is impossible just like "water, as long as it is dry

No, it is possible that they do some thing else to secure the money, not just password.

Using analogy can eventually break downs but its fine I'll go along.

Let say I need my car to be cleaned, I have only two requirements :

- the car is clean

- the car never get wet

So someone did that satisfied all my requirements. The car is clean and never get wet. Later on they told me that they use water all along.

Will I get mad ? No, why should I. They fulfill my requirements as I expected.

How they do that is implementation details, which is not my concern, its not part of my requirements.

Unless "not use water" is specifically part of my requirements, I wouldn't be mad at them.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#316

Post by dontbenebby »

otachack wrote: post #239
dontbenebby wrote: post #223

Earlier quoted context omitted.

This very looks cool, thank you for sharing parent. I apologize for the nitpick, but I hope there will be some guidance on what an "anonymous" email is. (Ex: Guerilla at a public wifi like a library, an email created at a library, but not your usual email from a place other than your home) I worry sometimes that we assume people reporting security vulnerabilities will be security experts. I often meet people who are…

An easier way may be to anonymously message a tech savvy media company or security firm, maybe via snail mail even. You can do it anonymously yourself but it'll take some work and a mashup of: - VPN service where you pay with cash (Mullvad) - Temporary email (Protonmail?) - One time use computer (cybercafe, pay with cash?) There's layers you can apply like a TOR browser usage but it'll take more effort/learning.

I've probably been watching too many true crime shows but I suspect it'd be difficult to send a letter w/o leaving fingerprints or dna

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#317

Post by bthrn »

mam2 wrote: post #310
slumdev wrote: post #117

Name and shame. I'll start: American Express passwords are not case sensitive. It is possible that they UPPER(...) the password before hashing it and then compare against that when you log in. This explanation would only be a little dumb because it reduces the domain of the password space. It also strains credulity.

facebook too

This is a feature, not a bug. Facebook accepts the inverse casing of your password as valid in case you accidentally have caps lock on while typing it.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#318

Post by carterehsmith »

o-__-o wrote: post #282
carterehsmith wrote: post #212

Earlier quoted context omitted.

Yeah, this "we can't extend password beyond 8 characters because legacy systems" argument does not hold water. My experience: built a Web site/app for: a) major bank b) major corp, back in the days when Web presence was kind of a new thing. ~15-20 years ago. You build a new (Web) app and treat the legacy system (happened to be some mainframe) as a backend or whatever. Add new tables to hold user's credentials, email…

Until 3 years ago, J.P. Morgan chase would only store the first 8 characters of your password. They would accept more but silently discard it

>> Until 3 years ago, J.P. Morgan chase would only store the first 8 characters of your password. They would accept more but silently discard it

Oh, I am sure they do. The big question for this thread is: how come this "8-character all-uppercase" password is a thing in States, but less of a thing in e.g. Europe.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#319

Post by NicoJuicy »

szatkus wrote: post #245
NicoJuicy wrote: post #199

Of the bank is in Europe also, it's a GDPR breach

How? My qwerty123 password isn't information directly connected to my identity.

GDPR Password Policy: Critical Components

https://www.enzoic.com/gdpr-password-policy-critical-compone...

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#320

Post by reinkaos »

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

TIL my Westpac password is case insensitive. Today wasn't a good day.
Post reply on HN