Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A major USA bank is storing passwords in cleartext – what to do?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 328 posts

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#81

Post by deadbunny »

tqkxzugoaupvwqr wrote: post #61
netsharc wrote: post #34

Earlier quoted context omitted.

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

Reminds me of TSB (UK bank) that asks, in addition to username and password, for three characters of a string when you sign in. Which is stupid because you can’t do it in your head easily. You actually need to see it written down somewhere when they ask for the 3rd, 11th and 15th character of that “memorable information”.

Pretty sure all UK banks use this method. For a while a tried to use a complex password for this, it became so annoying to use it is now a simple password that I can remember easily and count out. Like a downgrade attack on my brain.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#82

Post by dwnvoted2hell »

If you want to stay with this bank, you should should create a password from a strong one way military grade hash. This way, you can still more or less recreate the password, but if it's lost it tells nearly nothing about the original password you came up with, especially if you applied a salt (and/or pepper) to it.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#83

Post by reactor »

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Mainframe it is then.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#84

Post by Recursing »

crispyambulance wrote: post #75

> The service rep proceeded to (accurately) describe my own password to me. Wait, that alone doesn't necessarily indicate that they're storing clear text passwords. I notice you didn't say that they just repeated your password to you-- why do you think they store the whole thing in clear text? HN readers are apt to demand hardcore passphrases, salting, 2FA, etc. But the reality is that banks have to deal with all kin…

> Is there a law against clear text passwords

In Europe GDPR covers that, many big websites started hashing after it

Edit: could somebody explain the downvotes? The comments seem to agree with me

Obviously GDPR is not a law about plain text passwords, but as the comments say it forces "the use of an appropriate hashing algorithm to store your passwords, protecting the means by which users enter their passwords, defending against common attacks and the use of two-factor authentication." etc.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#85

Post by dwnvoted2hell »

0x3RO wrote: post #52

Do you really think the only thing the bank does to log people on is to check the username and password? Banks are way more sophisticated than this and it goes well beyond merely string-matching credentials; there's all sorts of other environment, behavioral and heuristic patterns used to establish legitimacy. Even if you rose this issue with the bank, they'll hardly change their modes of operation, and you certainly…

https://yourlogicalfallacyis.com/no-true-scotsman

Fallacy much?

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#86

Post by znpy »

reactor wrote: post #83
chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Mainframe it is then.

could be (old) cobol, not necessarily on a mainframe

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#87

Post by daveoc64 »

deforciant wrote: post #58
lpilot wrote: post #38

Santander in the UK does this too. You can tell because they only ask for 3 characters out of your password whenever you log in. What's ironic is that whoever did that propably thought they were being super clever.

Other banks in UK do that as well, shouldn't they all be reported for this?

To whom, and on what basis?

There is nothing in UK law that says banks have to store your passwords "securely".

Issues like this have been raised in the past, and authorities like the ICO have said no law is being broken. GDPR, for example, does not specify technical mechanisms required to store any form of data.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#88

Post by e2le »

tqkxzugoaupvwqr wrote: post #61
netsharc wrote: post #34

Earlier quoted context omitted.

I know a bank (I forget which, in EU) that asked me for the 3rd and 5th letter to my password when I called them. Their thinkkng was probably that way the customer support on the other end would only see 2 letters of said password.

Reminds me of TSB (UK bank) that asks, in addition to username and password, for three characters of a string when you sign in. Which is stupid because you can’t do it in your head easily. You actually need to see it written down somewhere when they ask for the 3rd, 11th and 15th character of that “memorable information”.

For the "memorable information", I use a 32 character string that was generated with pwgen. I don't ever remember it asking me for the 25th or 30th character, it's always within the first 20 characters.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#89

Post by the_french »

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

Even worse, a major French bank removed their perfectly fine password requirements and replaced it with a 6 digit PIN that you have to enter via an on-screen numpad. They explicitly block password managers from autofilling too! And I had just managed to get my parents to start using one.

Re: Ask HN: A major USA bank is storing passwords in cleartext – what to do?

#90

Post by stazz1 »

chris_overseas wrote: post #80

One bank that has astoundingly bad password requirements is Westpac Australia. Usernames are an 8 digit customer ID, and passwords have to be exactly 6 characters long(!) consisting only of numbers and uppercase letters. Try it for yourself, note that the login form only allows you to enter 8 characters for the username and 6 characters for the password: https://banking.westpac.com.au/ I complained to them about this…

"We know what we're doing" and "There's no way we can upgrade the infrastructure" might be holding hands in that moment
Post reply on HN