[deleted]
Ask HN: A major USA bank is storing passwords in cleartext – what to do?
41–50 of 328 posts
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#42Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…
I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.
With my bank, the telephone banking password is very different from the one you use to log in.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#43Same surprise for me when I got back my password from AMEX over phone.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#44When I went to TSB (UK) open an account for my partner and she was asked to type her password on their computer she asked when she can change the password, are they any limitations, like wait 3 days before changing password. The assistant responded "why would you ever want to change your password? you can type any password you want now, just please type your password". This was so weird we didnt use the account for a few days, changed the password, waited a few days again and after that deposited money.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#45If this is really happening this is a serious issue that needs to be fixed ASAP and everyone alerted..
but.. something doesn't look right here..
OP is a throwaway account created today, which I can understand for this type of thing.. but...
they withheld the bank name in the title/desc.. okay again a responsible thing to do.. but...
when asked what the bank name was in the comments they were not shy at naming it..
Something just doesn't feel right. Why the sudden change of heart?
For everyone's sake I hope I'm right, that this is just FUD.. to the OP if you really are serious I'm sorry, and please do report this ASAP.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#46When I went to TSB (UK) open an account for my partner and she was asked to type her password on their computer she asked when she can change the password, are they any limitations, like wait 3 days before changing password. The assistant responded "why would you ever want to change your password? you can type any password you want now, just please type your password". This was so weird we didnt use the account for a…
But you were talking to a clueless bank clerk, not their Chief Infosec Officer, so not really that significant.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#47Move your money to a different bank. Now that banks aren't paying useful interest rates they are mostly only tolerable for security and convenient access to your money. If they can't do those two then... what exactly are they for? Likely nothing.
It's for an auto loan.
Be extra careful with your details associated with that account and anything it touches. eg any direct debits might "change" without notice. Enable all added security you can.
But realistically, there's no silver bullets. Refinancing can be expensive. Cost/benefit applies: Might not be worth refinancing just for this. Just be vigilent about the accounts involved.
I had a phone company that bragged about its security. So I tested them out. Yup they sent my password via text. Ok then. Contract was for six months. Not worth switching. But also not worth renewing.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#48I got locked out of my account (forgot my password) with said bank and they had no way of telling me my password. Had to wait for them to send me a OTP mailer so that I could login and create a new password.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#49Banking security is a joke.
My bank calls me to talk to me and insists I give them my date of birth and address to ‘verify’ myself.
Meaning anyone can call me, pretend to be my bank, I am supposed to give them this info, and then they have what they need to verify themself as me.
Banks are dumb.
Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?
#50Earlier quoted context omitted.
>Might be real disruptive if you’re in the middle of buying a house. Agree, I consider this a damage but if the bank can avoid causing me any disturbance despite of using clear text password or then why should I be concerned ?
The same reason you might be concerned even if a doctor can deliver a baby safely despite not washing his hands in between a cadaver examination and touching your wife. Do you feel lucky? Well, do ya?
Sure, If the doctor can deliver baby safely and not causing any other damage despite not washing hands then what's the issue?
That's why I asked what is the actual damage. Is the money is stolen ? Is the money can't be accessed ? If the bank doesn't do me any actual damage despite the clear text password then I don't see why I should be concerned.
I guess I can see that for some people, clear text password usage can cause them anxiety and lose some sleep.