Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#51

Post by matz1 »

godferthomy wrote: post #37
matz1 wrote: post #25

Earlier quoted context omitted.

Maybe but that is their problem. Its still the bank responsibility to deal with that.

Well any risk is going to be paid by the customer in the end. If they lose 0.01% of their deposits because of a vulnerability, they're gonna be charged more by their insurance and eventually charge it on their service fees to customers.

Yes, if they cause the customer actual damage, such as increased fees then it is a concern. But if there is no actual damage then what's the issue?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#52

Post by 0x3RO »

Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly won't ever see a bank telling you how they do it, but those "hidden security features" make a significant contribution to the bank's security posture; ie: https://twitter.com/mbna/status/1016270694299127809?s=20

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#53

Post by 0x3RO »

0x3RO wrote: post #52

Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly…

In addition to this, you might be interested enough to take note of a number of your banks arbitrary password rules, that one could follow to make similarly negative assumptions. ie; "hey [bank], because my password is limited to 16 characters, does that mean you've got a varchar(16) column somewhere storing plaintext?"

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#54

Post by matz1 »

Carpetsmoker wrote: post #36
matz1 wrote: post #15

Is there actual damage? At the end of day, as a customer，all I care is my money is available (not stolen) and I can access it when I need it. Why should I care about implementation details ?

Would you trust a bank that protects their vault with the same kind of lock as your front door?

Yes I don't care how they do it as long as they can protect my money.

Likewise, they may use top of the line, super secure lock but if they can't protect my money, I wouldn't use them.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#55

Post by lozenge »

netsharc wrote: post #34
davismwfl wrote: post #2

Wow. Did they repeat your password or some hint you typed in a long time ago? FWIW I have seen two companies that store passwords properly in a one way hash with salt but store statistics on every password like number of case changes and count of numbers and total length. I personally think that practice is infinitely stupid but can explain why they can say it has 3 numbers in it. One major marketing firm I did work…

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

This also avoids replay attacks. Unless you use a word in which case it can be deduced.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#56

Post by alkonaut »

What does the password give access to? Full online banking (e.g. being able to do transactions?). Does login not require any further authentication beyond the password?

If the authentication still requires using some kind of good 2FA then it's less serious to have the password in plaintext. Still bad of course.

If this is for some other service that doesn't let you do any transactions then it's not as serious either (still bad and embarrassing, but not that serious)

Even with properly hashed passwords etc I'd be worried if my bank allowed login with only a username/password and no further security. I didn't think even that was a thing in 2020.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#57

Post by diffeomorphism »

matz1 wrote: post #54
Carpetsmoker wrote: post #36

Earlier quoted context omitted.

Would you trust a bank that protects their vault with the same kind of lock as your front door?

Yes I don't care how they do it as long as they can protect my money. Likewise, they may use top of the line, super secure lock but if they can't protect my money, I wouldn't use them.

> Yes I don't care how they do it as long as they can protect my money.

That is like saying I don't care about having a bucket of water thrown on me as long as I don't get wet.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#58

Post by deforciant »

lpilot wrote: post #38

Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.

Other banks in UK do that as well, shouldn't they all be reported for this?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#59

Post by easytiger »

lpilot wrote: post #38

Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.

The screen they are looking at isn't showing them all the numbers. Though it isn't fantastic as a security measure i admit.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#60

Post by perl4ever »

godferthomy wrote: post #37
matz1 wrote: post #25

Earlier quoted context omitted.

Maybe but that is their problem. Its still the bank responsibility to deal with that.

Well any risk is going to be paid by the customer in the end. If they lose 0.01% of their deposits because of a vulnerability, they're gonna be charged more by their insurance and eventually charge it on their service fees to customers.

You're implicitly suggesting that the bank can either pass on the costs without people noticing, or that they have no competition, so they can set fees and interest rates to whatever they like. I don't think either is true. We do regulate banks, and this is why it's vital.

You could just as well say the cost is going to be paid by the shareholders, the public (in the form of reduced taxes), or the employees.

Post reply on HN